Wispr Flow

Users retain ownership of the Inputs they submit; Wispr does not claim ownership. To operate the service, users grant a broad, sublicensable license limited to providing, improving and protecting the Services, which is standard but wide.

Wispr assigns to the user all of its right, title and interest in the Output generated for them. The Terms note that outputs may not be unique and that identical Third-Party Outputs generated for others belong to those users, which is inherent to generative AI.

Wispr can use Customer Content to train its AI models, but only if the user enables the 'Improve the model for everyone' / model training setting, and users can disable it. Meeting audio is excluded from training unless separately enabled, and Google User Data is never used for generalized model training. The default state and granularity are governed by a separate Data Controls page not supplied here, so residual ambiguity remains.

The privacy policy describes retention qualitatively ('only for as long as is necessary') rather than with concrete schedules or a deletion SLA for consumers. It does commit to deleting/de-identifying Google Workspace data within a commercially reasonable period after disconnection, and states data shared with third-party LLMs is generally deleted within 30 days. Absence of a firm consumer deletion timeline lowers the rating.

Sharing is disclosed and largely tied to service delivery: service providers, third-party LLMs (OpenAI/Anthropic), payment processing (Stripe), and analytics. Wispr states it does not sell data and that SMS opt-in data is not shared. However, the policy also permits disclosure to advertising partners (e.g. LinkedIn) and in business transfers, which is broader than strictly necessary for the core dictation service.

The policy provides multiple, concrete opt-out mechanisms: a model-training toggle, the ability to opt out of the Context Awareness feature, marketing/SMS unsubscribe, Google Analytics opt-out, and ad-network opt-out links. GDPR consent withdrawal rights are also stated.

The privacy policy displays SOC 2 and HIPAA badges (image assets) and the policy text addresses GDPR rights and a California/CCPA supplemental notice, but no audit report, certificate, or trust-center link substantiates the badges. Against the enterprise_saas baseline (SOC 2 Type II, ISO 27018) and universal baseline, frameworks are asserted or implied rather than evidenced with third-party attestation.

The consumer documents provide no transparency into model behavior, no enterprise audit rights, and no explainability commitments. They disclaim output accuracy extensively and identify the underlying LLM providers, but offer no auditing mechanism for the user.

The policy states generic technical, administrative and physical safeguards and mentions encrypted on-device meeting audio, but discloses no specifics (encryption at rest/in transit standards, pen testing, incident response, breach history). A SOC 2 badge is shown but no security page or trust center is linked in the supplied text. No breaches are disclosed.

The consumer documents themselves reference employer/customer access ('If a customer of Wispr (e.g. your employer) has given you access') but do not detail material data-handling differences between free and paid consumer tiers. Substantive enterprise protections appear only in the separately supplied MSA/DPA, not in these consumer terms, so from the consumer document alone the delta is largely unstated.

Wispr reserves the right to review user conduct and content for compliance with the Terms. The broad content license permits access and storage, and service providers may access data to perform tasks, but there is no explicit routine human review of prompts/outputs described. The compliance-review reservation creates some ambiguity.

The documents address legal/government requests via standard disclosure-for-compliance language and detailed dispute-resolution provisions (mandatory arbitration, class-action waiver, opt-out within 30 days). No pending litigation or specific government data requests are disclosed. The arbitration/class waiver is vendor-favorable but includes a consumer opt-out.

Wispr collects a broad set of PII (name, email, phone, IP, device identifiers, usage data) plus voice audio, meeting transcripts, calendar/contacts/directory data and, with permission, Gmail metadata and content — potentially including sensitive communications content. Collection is disclosed with purpose limitation and opt-in controls (e.g. Context Awareness, Google scopes), and payment data is handled by Stripe, which raises the footprint above minimal but with adequate notice.

Both consumer documents are dated 'Last Updated: August 19, 2026', roughly one month before the analysis date, so recency is strong. Coverage is good: the policy explicitly addresses AI/LLM processing, named third-party model providers (OpenAI/Anthropic), the Notetaker meeting features, and Google integrations that the product surface advertises.

Two consumer documents (Terms of Service and Privacy Policy) were supplied and both are dated August 19, 2026. They are mutually consistent on the key issues — user retains Input, owns Output, model-training is opt-in/controllable, and third-party LLMs do not train on and delete data within 30 days. No contradictions were identified between them.