Privacy Policy

Wisper turns your voice into writing, which means you trust us with something personal: the way you think out loud. This policy explains, in plain language, what we collect, why we collect it, how long we keep it and the control you have over it.

The short version:

• Your words are yours. We process your voice to produce your text, and for nothing else unless you explicitly tell us otherwise.
• We do not sell personal data, and we never use it for advertising.
• We do not train AI models on your recordings or transcripts unless you opt in.
• Audio is short-lived. Recordings are deleted once your text has been produced, unless you choose to keep them.
• You can see, export and delete your data at any time.

Who we are

This policy applies to the Wisper website at wisper.in, our early-access programme and the Wisper dictation apps and services (together, the "Service"). The Service is operated by Wisper ("Wisper", "we", "us").

For the purposes of India's Digital Personal Data Protection Act, 2023 ("DPDP Act"), we are the Data Fiduciary for the personal data described here. Where the EU or UK General Data Protection Regulation ("GDPR") applies, we are the controller.

If you use Wisper through an organisation's Teams plan, your organisation decides how the workspace is used. For content created in that workspace we act on its instructions as a processor, and its own privacy notice also applies to you.

Information we collect

We collect only what we need to run the Service well. What that means depends on how you interact with us.

Information you give us

• Waitlist and early-access sign-ups. Your email address and, where you provide it, how you heard about us.
• Account details. Your name, email address, password (stored only as a salted hash) or sign-in provider identifier, and your preferences, such as language, custom vocabulary and writing style.
• Messages to us. When you use our contact form or email us, we receive your name, email address, organisation (if given) and whatever you choose to include in your message.
• Billing details (when paid plans launch). Payments are handled by a payment processor. We receive confirmation of payment, your plan, and limited card details such as brand and last four digits. We never see or store full card numbers.

Voice and text content

When you dictate, we process:

• Audio recordings of what you say while dictation is active. Wisper listens only when you activate it. It does not record in the background.
• Transcripts and refined text, meaning the raw transcription and the cleaned-up text we return to you.
• Context you enable, such as custom vocabulary, names and terminology you add so the output sounds like you.

We call this your content. It is the most sensitive information we handle, and we treat it accordingly (see How we treat your voice and text).

Information collected automatically

• Usage information. Features used, dictation session counts and duration, error events and performance timings. This tells us what works and what breaks. It does not include the words you dictate.
• Device and log information. Device type, operating system, app version, browser type, IP address (used to infer an approximate country and to protect the Service), and timestamps.
• Cookies and similar technologies. Explained in our Cookie Policy. Non-essential analytics run only with your consent.

Information from others

If you sign in with a third-party provider such as Google or Apple, we receive the basic profile information you authorise, typically your name, email address and a unique identifier.

How we treat your voice and text

Your content gets stricter rules than any other data we hold:

1. Processed for you, by default for nothing else. We process audio to produce your text, and text to apply the refinements you ask for. That is the default and it requires no extra setting.
2. Short-lived audio. Audio is deleted from our systems once processing is complete, normally within seconds. If you turn on Save recordings (off by default), we keep recordings in your history until you delete them.
3. No training without consent. We do not use your recordings, transcripts or refined text to train or improve AI models, ours or anyone else's, unless you turn on Help improve Wisper in your settings. You can turn it off at any time, and we will stop using content collected after that point.
4. No human review by default. Our staff do not listen to recordings or read your text. Narrow exceptions are: when you explicitly share a sample with support, when necessary to investigate abuse or a security incident, or when required by law. Any such access is logged.
5. AI providers under contract. Some processing may run on carefully selected AI infrastructure providers. They act only on our instructions, are contractually prohibited from using your content to train their models, and must delete it after processing.

How we use information

Under the DPDP Act, we process your personal data on the basis of the consent you give for each specific purpose above, or for the legitimate uses the Act permits, such as complying with law. We tell you the purpose before we collect data, and we use it only for that purpose.

We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing.

How we share information

We share personal data only in these situations:

• Service providers (processors). Companies that host our infrastructure, provide speech and language processing, send email, process payments, or help us with support and security. Each is bound by a written contract that limits use to providing services to us and requires appropriate security. We will publish and maintain a current list of our sub-processors before general availability.
• Your organisation. If you use a Teams workspace, workspace administrators can manage accounts and may be able to access content created in that workspace, as set by your organisation.
• Legal requirements. When we believe in good faith that disclosure is required by law or a valid legal process, or is necessary to protect the rights, safety or property of our users, the public or Wisper. Where the law allows, we will tell you before disclosing your information.
• Business transfers. If Wisper is involved in a merger, acquisition or sale of assets, personal data may transfer as part of that transaction. It would remain protected by this policy, and we will notify you before it becomes subject to a different one.
• With your direction. When you ask us to, for example by connecting an integration.

We do not sell or rent personal data, and we do not share it for cross-context behavioural advertising.

International transfers

We may process data in India and in other countries where we or our service providers operate. Whenever personal data moves across borders, we make sure it remains protected. For transfers of EU or UK personal data, we rely on adequacy decisions or the European Commission's Standard Contractual Clauses (with the UK Addendum where relevant). We comply with any restrictions the Government of India notifies under the DPDP Act.

How long we keep information

We keep personal data only for as long as we need it for the purposes above:

Backups are overwritten on a rolling basis, so deleted data can persist in encrypted backups for a short period before it is permanently removed.

How we protect information

We use administrative, technical and physical safeguards appropriate to the sensitivity of the data, including encryption in transit and at rest, strict access controls and continuous monitoring. Our Security page explains these in detail. No system is perfectly secure, but if a breach affecting your personal data occurs, we will notify you and the relevant authorities as the law requires, including the Data Protection Board of India.

Your rights and choices

Depending on where you live, you have some or all of these rights:

• Access. Get a summary of the personal data we hold about you and how we process it, and a copy of it.
• Correction and completion. Fix inaccurate or incomplete data, or update it.
• Erasure. Ask us to delete your personal data. You can also delete content and your account directly in the app.
• Portability. Receive your content and account data in a common, machine-readable format.
• Withdraw consent. Where we rely on consent, withdraw it at any time. This is as easy as giving it, and it doesn't affect processing that already happened.
• Objection and restriction. Object to processing based on legitimate interests, or ask us to restrict processing in certain circumstances.
• Nominate a representative. Under the DPDP Act, you can nominate someone to exercise your rights if you die or become incapacitated.
• Grievance redressal. Raise a concern with our Grievance Officer, and if you are not satisfied, escalate it to the Data Protection Board of India. If you are in the EU or UK, you may also complain to your local data protection authority.

To exercise any of these rights, email privacy@wisper.in or choose "Privacy request" on our contact form. We may need to verify your identity first. We respond within 30 days, or sooner where the law requires.

You can also:

• Unsubscribe from product emails with the link in any message.
• Manage cookies from the Cookie Policy page or the "Cookie preferences" link in the site footer.
• Control your content with the Save recordings and Help improve Wisper settings, and by deleting history items.

Children

The Service is not directed at children. You must be at least 18 years old to create an account, or the age of majority where you live if that is higher. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact privacy@wisper.in and we will delete it.

Changes to this policy

We will update this policy as the Service evolves. When we make material changes, we will tell you in advance by email or in the app, and update the "Last updated" date above. Where a change requires your consent, we will ask for it.

Contact us

For any question about this policy or how we handle your data:

• Privacy team: privacy@wisper.in
• Grievance Officer: privacy@wisper.in. We acknowledge grievances promptly and aim to resolve them within the timelines the law sets.
• Security issues: security@wisper.in, or see our Security page