WhistleCore

Terms of Service

Last Updated: August 2026

1. Introduction & Acceptance

Welcome to WhistleCore ("Platform", "Service", "we", "us", "our"). These Terms of Service ("Terms") constitute a legally binding agreement between you (the "Customer", "Company", "you") and WhistleCore governing your access to and use of the WhistleCore whistleblowing compliance platform, website, APIs, and all related services. By registering for an account, accessing, or using the Service, you acknowledge that you have read, understood, and agree to be bound by these Terms in their entirety. If you do not agree to these Terms, you must not use the Service.

2. Definitions

The following definitions apply throughout these Terms:

  • "Customer" or "Company" refers to the legal entity or natural person that registers for and subscribes to WhistleCore.
  • "Whistleblower" refers to any individual who submits a report through a Customer's WhistleCore reporting channel.
  • "Report Data" refers to all content submitted by Whistleblowers, including text, metadata, and any associated communications, which are encrypted using Zero-Knowledge end-to-end encryption.
  • "Admin Data" refers to Customer account information such as email addresses, company names, billing details, and team member profiles.
  • "Master Password" refers to the password set by the Customer to encrypt and decrypt their private key, which is required to access Report Data.

3. Service Description & Separation of Roles

WhistleCore is strictly a software-as-a-service (SaaS) technology provider. We provide the technical infrastructure — including encrypted reporting channels, secure messaging, case management dashboards, and audit logging — to enable Companies to receive and manage anonymous whistleblower reports.

WhistleCore does NOT provide legal advice, does NOT act as a judicial or regulatory authority, does NOT investigate reports, and does NOT make compliance determinations. The Customer (Company) is solely and entirely responsible for: (a) reviewing and acting upon submitted reports in a timely manner; (b) appointing competent and impartial persons to handle reports as required by applicable law; (c) complying with all applicable local, national, and EU laws including but not limited to EU Directive 2019/1937, the German Hinweisgeberschutzgesetz (HinSchG), and the French Loi Sapin II; (d) preventing retaliation against Whistleblowers; and (e) maintaining legally compliant internal procedures for whistleblower protection.

4. Account Registration, Eligibility & B2B Warranty

To use WhistleCore, you must: (a) be at least 18 years of age; (b) have the legal authority to bind your organization to these Terms; (c) provide accurate and complete registration information; and (d) maintain the security of your account credentials. You are responsible for all activities that occur under your account. WhistleCore reserves the right to suspend or terminate accounts that violate these Terms or that we reasonably believe are being used for fraudulent or illegal purposes.

The Service is intended strictly for professional, commercial, or organizational use. By registering, you warrant that you are accessing the Service for business or professional purposes (including as a sole proprietor or freelancer) and not as a private consumer. Consequently, statutory consumer rights, including the 14-day right of withdrawal, do not apply.

5. Zero-Knowledge Encryption & Irrecoverable Data Loss

CRITICAL WARNING: WhistleCore uses a Zero-Knowledge End-to-End Encryption architecture. Your private cryptographic key is encrypted exclusively with your Master Password. WhistleCore does NOT store, transmit, or have access to your Master Password at any time. We CANNOT recover, reset, or bypass your Master Password under ANY circumstances. If you lose your Master Password, you will permanently and irreversibly lose access to ALL encrypted Report Data. By using this Service, you explicitly acknowledge and accept this risk. WhistleCore bears no liability whatsoever for data loss resulting from a lost or forgotten Master Password.

6. Customer Responsibilities

As a Customer (Company Administrator), you bear full responsibility for:

  • Appointing competent, impartial, and trained persons to review and manage whistleblower reports in compliance with all applicable laws, including EU Directive 2019/1937, HinSchG (Germany), and equivalent national transpositions.
  • Responding to reports within the legally mandated timeframes (e.g., 7-day acknowledgment of receipt, 3-month feedback period as required by EU Directive 2019/1937).
  • Preventing any form of retaliation against Whistleblowers as prohibited by applicable whistleblower protection legislation.
  • Maintaining the confidentiality and security of your Master Password, account credentials, and private cryptographic keys.
  • Ensuring that your use of the Platform complies with all applicable data protection laws (including GDPR), labor laws, and industry-specific regulations.
  • Informing your employees and stakeholders about the availability of the reporting channel as required by law.

7. Subscriptions, Billing & Auto-Renewal

Free Trial: We offer a 7-day free trial period. No credit card or payment information is required to start a trial. At the end of the trial period, if you do not subscribe to a paid plan, your account will be suspended and subject to the data deletion policy described in Section 9.
Billing: Paid subscriptions are billed in advance on either a monthly or yearly basis through our Merchant of Record, Lemon Squeezy (Lemon Squeezy B.V.). All payment processing, invoicing, tax calculation, and PCI compliance are handled exclusively by Lemon Squeezy. WhistleCore does not directly store, process, or have access to your credit card numbers or payment instrument details.
Auto-Renewal: All paid subscriptions automatically renew at the end of each billing cycle (monthly or yearly) unless cancelled by you before the renewal date. You will be charged the then-current subscription fee upon each renewal. The renewal date is displayed in your dashboard. It is your responsibility to cancel before the renewal date if you do not wish to continue.
Cancellation: You may cancel your subscription at any time via the dashboard with a single click. Cancellation takes effect at the end of your current paid billing period — you retain full access until that date. Cancellation is designed to be no more difficult than signing up.

8. Refund Policy

All payments are final and non-refundable. We do not provide refunds or credits for partial billing periods, unused subscription time, or downgrade differences. If you upgrade from a Monthly to a Yearly plan, Lemon Squeezy will automatically calculate a prorated credit for the unused portion of your current billing period and apply it to the new plan. This is the only form of billing credit available. By subscribing, you acknowledge and agree to this no-refund policy.

9. Cancellation, Suspension & Data Deletion

Upon cancellation or expiration of your subscription, your account enters a suspended state. During suspension, your compliance dashboard and reporting channels are disabled, and no new reports can be submitted or accessed.

30-Day Grace Period: After suspension, we retain your data for exactly 30 calendar days to allow you to reactivate your subscription and regain access. After 30 days without reactivation, ALL data associated with your account — including encrypted reports, messages, audit logs, team member profiles, and company settings — is permanently and irreversibly deleted from our servers and all backups.
Immediate Deletion: If you wish to delete all data immediately without waiting for the 30-day grace period, you may use the "Delete Company" button available in your dashboard settings. This action is immediate, permanent, and irreversible.

Under the EU Whistleblower Directive, companies are required to retain report documentation for a period determined by national law (typically 2-3 years after case closure). It is the Customer's sole responsibility to ensure that reports are retained for the legally required period before cancelling their subscription or deleting data. WhistleCore is not liable for any data deleted upon the Customer's cancellation or explicit deletion request.

10. Limitation of Liability & "As-Is" Warranty

THE SERVICE IS PROVIDED STRICTLY "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, INCLUDING BUT NOT LIMITED TO IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT.

WhistleCore does NOT guarantee: (a) 100% continuous, uninterrupted, or error-free availability of the Service; (b) that the Service will meet your specific requirements or expectations; (c) that any particular report will be delivered, received, read, or acted upon; (d) the accuracy, reliability, or completeness of any information provided through the Service; or (e) that the Service will be free of viruses, security vulnerabilities, or harmful components.

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL WHISTLECORE, ITS FOUNDERS, DIRECTORS, OFFICERS, EMPLOYEES, AGENTS, OR AFFILIATES BE LIABLE FOR ANY: (a) INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES; (b) LOSS OF PROFITS, REVENUE, DATA, GOODWILL, OR BUSINESS OPPORTUNITIES; (c) COST OF PROCUREMENT OF SUBSTITUTE SERVICES; (d) DAMAGES ARISING FROM MISSED, IGNORED, OR MISHANDLED REPORTS; (e) FINANCIAL, REPUTATIONAL, OR REGULATORY HARM SUFFERED BY THE CUSTOMER OR ANY THIRD PARTY; REGARDLESS OF THE THEORY OF LIABILITY (CONTRACT, TORT, NEGLIGENCE, STRICT LIABILITY, OR OTHERWISE), EVEN IF WHISTLECORE HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

WhistleCore's total aggregate liability for any and all claims arising out of or relating to these Terms or the Service shall not exceed the total fees actually paid by the Customer to WhistleCore during the twelve (12) months immediately preceding the event giving rise to the claim.

11. Indemnification

The Customer agrees to indemnify, defend, and hold harmless WhistleCore, its founders, directors, officers, employees, agents, and affiliates (collectively, the "Indemnified Parties") from and against any and all claims, demands, lawsuits, actions, proceedings, losses, damages, liabilities, costs, and expenses (including reasonable attorneys' fees and court costs) arising out of or relating to:

  • The Customer's use or misuse of the Service;
  • False, malicious, defamatory, or fraudulent reports submitted through the Customer's reporting channel by any person;
  • The Customer's failure to review, act upon, or properly handle any report in accordance with applicable law;
  • Any act of retaliation against a Whistleblower by the Customer, its employees, officers, or agents;
  • The Customer's violation of any applicable law, regulation, or third-party rights;
  • Any claim by a Whistleblower, employee, regulatory body, or third party arising from the Customer's conduct or failure to act.

This indemnification obligation shall survive the termination or expiration of these Terms and the Customer's subscription.

12. Intellectual Property

WhistleCore and its licensors retain all intellectual property rights in the Platform, including but not limited to the software, algorithms, user interface designs, trademarks, logos, and documentation. The Customer retains ownership of all Report Data and Admin Data submitted to the Platform. WhistleCore claims no ownership over Customer data. The Customer grants WhistleCore a limited, non-exclusive license to process and store Customer data solely for the purpose of providing the Service.

13. Prohibited Uses

You agree NOT to:

  • Use the Service for any illegal, fraudulent, or unauthorized purpose;
  • Knowingly submit false, fabricated, or malicious reports through any reporting channel;
  • Attempt to reverse engineer, decompile, disassemble, or otherwise derive the source code of the Platform;
  • Attempt to circumvent, disable, or interfere with any security features of the Service;
  • Use the Service to harass, defame, threaten, or harm any individual;
  • Resell, sublicense, or redistribute the Service without prior written consent from WhistleCore.

14. Artificial Intelligence Disclosure

WhistleCore does NOT use artificial intelligence (AI), machine learning (ML), large language models (LLMs), or any form of automated decision-making to process, analyze, classify, read, summarize, or make determinations about whistleblower reports or any Customer data. All report content is encrypted end-to-end and can only be decrypted and read by the Customer using their private key and Master Password. WhistleCore has no technical ability to access or process the plaintext content of reports.

15. Governing Law & Dispute Resolution

These Terms shall be governed by and construed in accordance with the laws of the Federal Republic of Germany, without regard to its conflict of law provisions. Any disputes arising out of or in connection with these Terms shall be submitted exclusively to the competent courts in Germany. The parties agree that they shall not bring or participate in any class action, collective action, or representative proceeding against WhistleCore. All claims must be brought individually.

If any provision of these Terms is held to be invalid, illegal, or unenforceable, the remaining provisions shall continue in full force and effect.

Contact: whistlecore.support@gmail.com