Whistle Pro privacy notice

Controller and privacy contact

Whistle Pro is operated by IRELCO LTD under the FOLO-UP brand. IRELCO LTD is the controller for the personal information described in this notice, registered in England and Wales, company number 15377065. Postal contact: Goldworks, Mill Lane, Ebbw Vale, NP23 6GR, United Kingdom.

For privacy information, access, correction or other rights requests, email contact@folo-up.co.uk. For software connection support, email whistle@folo-up.co.uk. Never send passwords, one-use pairing codes or private browser credentials.

Purpose and your choices

Whistle helps authorised professionals identify the selected product listing, check recorded listing signals, submit documented concerns and continue evidence-led review. A report is a listing signal for evidence capture and controlled human review, not a confirmed safety or conformity finding. FOLO-UP is an independent initiative, not a regulator.

Processing is limited to those requested functions, account and installation support, report integrity, security and reliability. The service relies on the controller’s legitimate interests in providing a proportionate product-safety service and preventing abuse. Publication is a separate explicit choice. Do not include unnecessary medical information or another person’s private details; health or other special-category information requires a suitable additional basis for its use.

After disclosure acceptance, automatic listing checks can run while the panel is active. You can turn them off and use Check now for one deliberate check; checks pause while the panel is hidden, unfocused or idle. Updates preserve your saved choice. Removing browser data or uninstalling removes local data and does not itself erase server records.

Named professional identity

IRELCO authenticates your account. This website receives a stable IRELCO account reference, email, platform role and application entitlement. It never receives your IRELCO password. Professional name, organisation, expertise, approved reporting scopes, vetting decision and expiry are recorded separately. Scope decisions and product-category review notes are retained in the private audit record. Account access does not itself verify expertise.

Marketplace listing and review content

On supported marketplace pages, the extension can read the page address and visible content needed to identify the selected offer and provide guidance. This can include title, listing and variant identifiers, variant wording, price and currency, seller, product image, brand, SKU, GTIN, MPN, category, description and the selected delivery context. It can also store user-taught CSS selectors for a marketplace connector. Automatic status checks send a purified listing address to the configured Whistle API while the panel is active and after disclosure acceptance; turning automatic checks off leaves a user-requested “Check now” action.

When Reviews analysis is opened, the extension reads locally available review headlines, text, star ratings, variants and source pages, or item-specific eBay seller-feedback text and rating. Amazon UK and Australian analysis can also request the marketplace’s same-origin star-filter pages. These are normal browser requests and may carry that marketplace’s existing cookies; Whistle does not read those cookies or your marketplace password. This content is analysed locally and is not sent to the Whistle service. A bounded Amazon evidence cache in local extension storage keeps up to 100 reviews for each of at most 12 selected products. Records older than 30 days are removed when the cache is next read or updated. Cache entries are separated by product and marketplace.

Disclosure acceptance and the automatic-check choice are saved in Chrome synchronised storage and may follow the signed-in Chrome profile. The idle delay, selected guidance category, checklist progress, taught connector selectors and review cache remain in local extension storage. Temporary session identifiers and product context use browser session storage. Public receipts belong to the separate Public edition; existing local records are not silently deleted by a Pro update. Interaction and focus timing used to pause checks stays in page memory.

Requests for additional expertise categories

You can request another category by recording your qualification, issuer, optional certificate or registration reference, relevance and supporting evidence. Issuer verification links, qualification documents and reviewer decisions remain private to you and the authorised review team. Evidence is locked when submitted. Requests alone do not grant expertise: another administrator must review the qualification, and your professional status must be current. Your own approved categories cannot be changed through your account, even with administrator access. Request history and qualification evidence are private records covered by the retention and rights procedure below.

Central vetting and organisation authority

Current IRELCO administrators can review qualifications and download private supporting documents through the protected IRELCO vetting tool. Whistle retains the qualification, organisation identity, category authority, membership evidence and reviewer decisions. Verification links, decision notes and exact validity dates remain private. A qualifying published assessment may additionally show the verified organisation name and website, applicable category, authority level and public explanation. Organisation authority requires current verified membership and matching individual expertise. It cannot supply missing qualifications. The private server integration key never reaches your browser; short-lived nonce digests prevent replay of signed integration requests.

Cases, evidence and communications

Your listing URLs, product/model details, observations, third-party evidence, inference, requested action, private evidence files, case messages, actions and review history are retained in this website’s SQLite database. The case author and authorised review team can access the case. A review-team member can assign a case to an actively vetted professional approved for its confirmed product category. Assignment changes are audited; assignment does not transfer authorship or publication consent. The assigned professional can access the private case while assigned. File downloads are permission checked. The application records timestamps for case events and messages. Private conflict notifications have the unread/read state described below; the retired extension Messages inbox and its delivery/opening receipts are separate features and are not used by this Pro edition.

Conflicting professional assessments

Reviewer-specific decisions are retained separately for the exact listing and recorded model. If current evidence-based decisions conflict, Whistle keeps a public review-pending alert without presenting the disagreement as a confirmed safety finding. The system creates a private discussion for authorised reviewers, qualifying report authors and the currently eligible assigned specialist, and records an internal unread notification for each participant. Conflict access rechecks the current assignment and vetting state; a former or no-longer-eligible assignee cannot continue reading the thread merely because they appear in its participant history. Conflict messages and read timestamps remain private. They do not create email, desktop or regulator notifications.

Quick ordinary reports and later expert assessments

A connected Pro user can send the same concern reason, structured injured/not-injured answer where a failure is reported, and good-faith confirmation as a Public reporter, without assessment text or named-publication consent. Optional text can also contain incident or injury details. The case, reason, any optional observation and timestamp remain linked privately to the account. The ordinary listing count is public; the quick report does not publish the account identity, reason text, evidence or messages. Completing a private assessment keeps the original ordinary signal. Explicit named-publication consent publishes the completed assessment in the same case and replaces its ordinary weight only where the scope checks pass; it never creates a second count. Withdrawing that assessment returns to the original ordinary signal.

What becomes public

Publication requires a separate explicit choice. A published report can expose the contributor name, organisation, expertise or scope, model, summary, publication date and selected public evidence links. Professional weighting appears only where current vetting, an approved expertise scope and a matching team-confirmed product category all apply. Other reports are labelled ordinary concerns, without an expert endorsement. Scope removal, expiry or category correction removes professional weight immediately; the ordinary report remains unless withdrawn. Suspension removes the report from the public view. Exact vetting or authority-validity dates, private vetting evidence, private files, IRELCO account reference, email, browser credentials and team messages are excluded. Purple indicates a vetted concern within approved expertise and a team-confirmed product category, not a confirmed safety finding. Green/Black outcomes require a recorded review and evidence source.

Review progress and live status

Saved category bases and reviewer-specific decisions are retained in the authorised private case. Reopening a review removes that reviewer’s earlier final public outcome. The new review explanation and its supporting link remain private while the public listing displays review progress. Unsaved changes to category and review forms stay only in page memory until saved, and are cleared on sign-out. With automatic checks enabled, visible panels recheck the current purified listing address about every fifteen seconds and when returning to the panel. Refresh checks immediately; it does not submit a report.

Shared public report dataset

Supported Public editions and Pro read the same public listing counts, published assessments and current review status. The view reads accepted ordinary reports from the established FOLO-UP intake and public projections from this workspace. Existing reports are preserved. Private cases, evidence, account details and messages are excluded. Ordinary Public submissions use the established intake, whose keyed installation and session fingerprints prevent duplicates. Structured concern reasons, optional detail, timestamps and acceptance/duplicate provenance are retained privately in this workspace’s audit without storing raw installation or session identifiers. This record does not create another public count. Legacy professional access keys do not grant vetted expertise.

Extension credentials and listing signals

A ten-minute one-use pairing code connects a browser to your vetted account. The maximum number of active browser credentials is held on your IRELCO user record, normally two, and can be adjusted there by an authorised administrator. Whistle reads the current allowance from IRELCO when it displays connected browsers, creates a code and redeems a code; Whistle does not own or persist that allowance. Reducing the allowance blocks new pairing while the active count is at or above the new limit, but does not silently revoke an existing credential. An allowance of zero disables new pairing. The oldest active browser is designated primary and any additional active browsers secondary. These are browser credentials; they do not prove which physical computer is in use. The browser stores its private 30-day credential and an identity summary locally and sends the credential only to the configured API over HTTPS. The server retains a hash, designation, browser label and connection timestamps, not the raw credential. Revoking the primary promotes the oldest remaining active browser. Revocation, expiry or suspended vetting prevents further use. Do not include credentials in emails or screenshots.

Both Pro and Public report requests send a random installation identifier and a temporary session identifier. The authenticated Pro route receives them but does not use them as professional identity. The ordinary intake retains keyed installation and session fingerprints, listing address, concern reason and timestamp rather than the raw identifiers. Public receipts are stored locally in that browser. This Pro edition does not issue a WI- support reference, register with the older installation registry, poll the inherited optional FOLO-UP Messages inbox, send its delivery/opening receipts or generate desktop notifications. Previously stored server records from older editions are not deleted by this update. The connection warning’s WPC code identifies a failure class, not an installation. Its support link includes only that code and the extension version in an email subject; it sends no email automatically.

Network addresses, cookies and service logs

The Pro application receives network addresses for request delivery and uses them transiently in memory for hourly rate limits. Ordinary submissions and compatibility checks also use the shared intake’s keyed network, installation and session bucket fingerprints. Raw network addresses are not report fields. Routine Pro Nginx access logging is disabled. Shared Nginx error logs can contain technical diagnostics and network addresses; they are configured for daily rotation with 100 retained rotations. Rotation depends on log activity and is not a guaranteed fixed deletion date. The system journal is configured for up to 14 days, also limited to 512 MB. Upstream identity and hosting providers can process their own service and security records.

Login cookies are HttpOnly, SameSite=Lax and Secure on the hosted service. Sessions expire after eight hours; sign-in state after ten minutes; IRELCO authorisation codes after ninety seconds. Pairing codes expire after ten minutes and are single-use. Browser credentials expire after thirty days unless revoked sooner. Expiry is not deletion of the associated case or audit history.

Retention and deletion

Cases, reports, evidence, qualifications, assignments, communications, review decisions, conflict notifications and audit records are retained only while needed to provide the service, preserve report integrity, support investigation and review, protect security, meet applicable obligations or establish or defend legal claims. Continuing need is reviewed during case handling and when a valid rights request is received. There is no implemented fixed automatic deletion date for these records. Closing a case, disconnecting a browser or uninstalling the extension is not a server-record deletion event.

Local identifiers, guidance and connector choices remain until changed or browser extension data is cleared. Chrome-synchronised disclosure and automatic-check choices are managed through the browser profile. Review evidence follows the 30-day, 12-product-and-market, 100-review limits above. Revoking an expired or unwanted credential removes its access, not the evidence held in a case. Backup access is restricted; retained recovery copies and any rights decision affecting them are reviewed as part of the relevant record-handling process.

Recipients and human review

Authorised IRELCO LTD administrators and FOLO-UP reviewers may read the specific information you submit for controlled human review, and currently authorised case participants can access the relevant private case. Access is restricted by role, current vetting and assignment. The IRELCO account service handles sign-in and entitlement; the hosting and technical service providers used to run Whistle process service data under the applicable arrangements. Where necessary and proportionate for the disclosed purpose or required by law, relevant information may also be provided to a product-safety authority, marketplace, seller, manufacturer, professional adviser, insurer or court. This is not an automatic regulator-notification service.

Whistle does not sell user data, transfer it for personalised advertising, use it for unrelated profiling or credit decisions, or permit unrelated human access. Public disclosure is limited to the information you explicitly choose to publish, as described above. If an international transfer is relevant, you can ask the privacy contact for the applicable supplier, location and safeguard; this notice does not certify an unverified hosting region or transfer arrangement.

Security

Hosted transmission uses HTTPS. The service uses revocable credentials, server-side credential hashes, access controls, restricted database and backup permissions, request limits and audit records. The application stores case data in SQLite; hashing a credential does not encrypt case evidence or browser storage. Provider-level encryption at rest and backup encryption have not yet been independently verified for this service. No encryption-at-rest guarantee is made here. Avoid unnecessary sensitive details and contact the privacy address with security concerns.

Your rights and how to request help

You may request information, access, correction, restriction, objection, portability or erasure where applicable. Email contact@folo-up.co.uk with enough information to locate the relevant account or case, such as your account email, listing URL or case reference and approximate dates. We use proportionate checks before disclosing or changing private information; a public reference or support error number alone is not proof of authority. Do not send a password, pairing code, private credential or unnecessary medical details.

An authorised handler assesses the request, relevant records, other people’s privacy and any specific continuing need for retention, then explains the outcome and any restriction. You can object to processing based on legitimate interests. Where an objection applies, processing will stop unless there are compelling legitimate grounds or the information is needed for legal claims. You can complain to the Information Commissioner’s Office ↗.

Whistle Pro is intended for authorised professional use. It does not send email automatically, notify regulators automatically or provide an emergency service. Material changes to this notice will be published with an updated notice version and effective date; changing the page does not itself change your browser choices or record a new acknowledgement.

Chrome Web Store Limited Use

The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements. Whistle Pro uses information received through Chrome extension APIs only to provide or improve its disclosed product-listing checks, local review and category guidance, reporting, case review, security and reliability. Whistle Pro does not sell user data, use it for personalised advertising or permit unrelated human access.

Creation credit

OI-Piloted, AI-Augmented. People direct, assess, decide and take responsibility; AI assistance in code and text remains transparent.