Privacy Policy

Last updated: 26 May 2026.

This policy explains what personal data Whispervoice collects, why it collects it, and what choices you have. It is written in plain English on purpose — the legal version is at the bottom.

Who we are

The data controller is Tumpak & Welge Media (see the imprint for full contact details). You can reach us at business@whispervoice.ai.

What we collect

1. Account data

When you sign in we store your email address and a hashed identifier so we can recognise you on return. We never store passwords — sign-in works via magic-link or OAuth (Google).

2. Voice transcripts (temporary)

When you press the hotkey, the recorded audio is sent over a TLS connection to our transcription provider (currently OpenAI), where it is processed into text. We then send the text to a cleanup model (currently Anthropic). Both providers process the request and return the result without retaining the audio or text for training, in accordance with their enterprise API terms.

Whispervoice does not retain a copy of your audio. We log the resulting word count for usage limits and billing, but the transcript text itself is not stored on our servers after delivery.

3. Usage and billing

We store the number of words you transcribe per month, your subscription tier, and — if you upgrade — your Stripe customer and subscription IDs. We do not store credit-card data; payments are handled entirely by Stripe.

4. Diagnostic logs

Server logs may briefly contain your IP address, browser user-agent, and the timestamps of requests. These are kept for up to 30 days and used to diagnose abuse or outages.

How we use it

• To deliver the transcription, cleanup, and translation features.
• To enforce monthly word limits on the Free plan.
• To process subscription payments (via Stripe).
• To send transactional emails (sign-in links, receipts, cancellation confirmations).
• To detect and prevent abuse.

We do not sell your data, and we do not run third-party advertising trackers on the site or in the app.

Sub-processors

We rely on the following providers to operate the service. Each is listed with the data they receive.

• Vercel (USA) — hosting and edge delivery. Receives IP and request metadata.
• Neon (EU) — managed Postgres database. Stores account data and usage counters.
• OpenAI (USA) — speech-to-text. Receives audio.
• Anthropic (USA) — cleanup and translation. Receives transcript text.
• Stripe (USA/Ireland) — payments. Receives billing identifiers and the price you are charged.
• Mailjet (EU) — transactional email. Receives your email address and the message.
• Google (USA) — OAuth sign-in (if you choose Google) and Google Analytics 4 for marketing-page traffic. Receives the standard OAuth claims and aggregate analytics events.

Transfers to providers outside the EU are covered by Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.

Your rights

Under the GDPR you have the right to access, correct, export, restrict, or delete your personal data, and to object to its processing. To exercise any of these, email business@whispervoice.ai from the address tied to your account.

You also have the right to lodge a complaint with the supervisory authority for our state (Hamburgischer Beauftragter für Datenschutz und Informationsfreiheit).

Retention

• Account data: kept while your account exists, deleted within 30 days of account closure.
• Voice audio: not retained — discarded after transcription.
• Usage counters and billing records: retained for 7 years to satisfy German tax law.
• Server logs: up to 30 days.

Cookies & analytics

We set a small number of strictly necessary cookies (session, theme preference, optional referral code).

We use Google Analytics 4 on the marketing pages of whispervoice.aito understand which pages convert and what visitors are looking for. GA4 records aggregate page-view and event data; we do not use it for advertising or cross-site tracking. You can opt out at any time via your browser's Do Not Track / GPC signal or with a third-party opt-out browser add-on.

We do not run third-party advertising trackers on the site or in the app.

Changes to this policy

If we make material changes we will notify signed-in users by email before the change takes effect. The current version is always available at this URL.