Privacy Policy

Data Controller

WheyWijzer is responsible for processing personal data as described in this privacy policy. For questions, contact us at the email address at the bottom of this page.

What data do we collect?

• Rating data: stars (1-5) and thumbs (up/down) you give to products.
• IP address: stored as a hash (encrypted) for spam prevention. The original IP address is not retained.
• Browser fingerprint: a hash of technical browser characteristics (screen size, timezone, language) for spam prevention. This is not unique identification.
• Cookie (ww_rid): a functional cookie to prevent duplicate ratings. Valid for 30 days.
• Language preference: stored in your browser (localStorage) to display the site in your language.
• Country detection: we use headers from our hosting provider (Netlify/Cloudflare) to detect your country. This is stored in a cookie (ww_country, 30 days) to show relevant products.
• Visitor counts: we count how often a page is viewed, per day, path, language and country. We place nothing on your device and read nothing from it, and we store no IP address, session or identifier that could recognise you. It is a running total, not a row per visitor, and two visitors cannot be told apart in it.
• Discount codes: when submitting a discount code, we store a hashed version of your IP address to prevent abuse (maximum 3 codes per IP per 24 hours).
• Code votes: when voting on whether a code works, we store a hashed version of your IP address to prevent duplicate votes.
• Review requests: when you request a review via our form, your brand name, product, email address and message are processed by Netlify Forms.
• Email: if you sign up for the newsletter or a price alert, we keep your email address, the language you want to be emailed in, and for a price alert the product and the amount you entered. Alongside that a hashed fingerprint of your IP address to limit sign-ups; that fingerprint is one-way and disappears after a day. We send a confirmation email first; if you do not click it within two days the request lapses and you hear nothing from us.

Cookies

Below is an overview of all cookies and similar technologies we use.

Why do we collect this data?

We collect this data solely to operate the rating system and prevent spam. When you accept all cookies, we use Google Analytics 4 to anonymously measure site usage. It is not loaded without your consent.

Third parties

We only share data with third parties when necessary for the operation of our service. Below is a complete overview:

• Google Analytics 4: only active after your explicit consent. IP addresses are anonymised. Google processes aggregated visitor statistics. Privacy policy: https://policies.google.com/privacy
• Netlify: our hosting provider. Processes web traffic, provides country detection via Cloudflare, and handles review request forms (Netlify Forms). Privacy policy: https://www.netlify.com/privacy/
• Awin and Daisycon: affiliate networks that track clicks to web shops. We do not share personal data; only an anonymous click reference is forwarded.
• Neon (PostgreSQL): our database provider, hosted in the EU (Frankfurt). Stores all product data and hashed user data. Privacy policy: https://neon.tech/privacy
• Brevo (Sendinblue, France): sends our confirmation email, the newsletter and the price alerts. For that they process your email address, the language you picked and the content of the message, on servers in France, Germany and Belgium. Brevo records whether a message was delivered, opened and clicked, and that cannot be switched off there.

Affiliate links

WheyWijzer earns a commission when you purchase a product through our affiliate links. Clicks are tracked by the affiliate network (Awin/Daisycon). No personal data is shared, only an anonymous click reference. This does not influence our rankings or reviews. All products are objectively evaluated regardless of affiliate partnerships.

Outbound click counts

We count how often a shop button is clicked, so we can see which products people find useful. We store only: the product, the shop, the page language and the time. We keep no IP address, no session and no reference to you at all. These figures cannot be traced back to a person and we do not build profiles with them.

The app

In the WheyWijzer app, your device creates a one-time access key so it may request our product data. We keep an installation code and the IP address of that first registration, purely to prevent abuse and overload. We do not link it to a name or email address. If you delete the app, you can ask us to revoke the key via the email address at the bottom of this page.

Price drop notifications

If you turn on notifications in the app, your device requests a push token from Apple or Google. That is a long string of characters we can use to send a notification to that one device. It says nothing about who you are.

We store that token together with your language, the platform you are on and the version of the app. We use it for price drop notifications about products you follow and for important messages about the app itself, such as an update being ready. Without a token we cannot send anything, so this only happens if you ask for it yourself.

If you turn notifications off again, the app immediately marks the token as inactive with us and we send nothing to it. After twelve months without use we delete it entirely, along with the favourites attached to it.

Your favourites

A price drop notification is only possible if we know which products you follow. That is why the app sends your list of favourites. This only happens while notifications are on.

These are references to products in our database, linked to your device's token. So we know which device follows which products, and not who uses that device.

With notifications off, the app stops sending favourites. Whatever was already sent stays with the inactive token until you have the app delete it, or until the twelve months have passed.

What never leaves your device

Your diary, your comparison list and your settings stay on your device. We have no copy of them and cannot access them.

Legal Basis

We process data on the following legal bases: (1) Consent (Art. 6(1)(a) GDPR): Google Analytics is only activated after your explicit consent via the cookie banner. (2) Legitimate interest (Art. 6(1)(f) GDPR): preventing spam and abuse via IP hashing, fingerprinting and cookies. Affiliate tracking also falls under legitimate interest. (3) Consent (Art. 6(1)(a) GDPR): email addresses for the newsletter and price alerts. You give that consent by clicking in the confirmation email, and you withdraw it with the unsubscribe link under every message.

Retention Period

Rating data and associated hashes: maximum 30 days, then automatically deleted. IP hashes for discount codes and votes: indefinite (anonymised). Newsletter emails: until you unsubscribe, then thirty more days and deleted. Price alerts: until the alert fires or you unsubscribe, then thirty more days and deleted. Sign-ups that are not confirmed within two days lapse. IP hashes from sign-ups: 24 hours, after which they serve no purpose. The send log we use to trace failures: thirty days. Google Analytics data: according to Google's own retention policy. Cookies: ww_country and ww_rid maximum 30 days, cookie_consent permanent until you change it.

Your Rights

Under GDPR you have the following rights:

• ✓ Right to access your data
• ✓ Right to rectify your data
• ✓ Right to erasure of your data
• ✓ Right to restrict processing
• ✓ Right to object to processing
• ✓ Right to lodge a complaint with a supervisory authority

If you believe we are not handling your data carefully, you have the right to file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, https://autoriteitpersoonsgegevens.nl).

Contact

For privacy questions or to exercise your rights, contact us at: contact@whey-wijzer.fit

Changes

This privacy policy may be updated. The most current version is always available on this page. Last updated: March 2026.