Wisprflow

The Terms clearly state that users retain ownership of their content and inputs, and Wispr does not claim ownership. The vendor takes only a limited license to provide, improve, and protect the Services.

Users own the AI-generated Output, and Wispr assigns any interest it may have to the user. The only caveat is that outputs may not be unique and users have no rights to Third-Party Outputs, which is standard for generative AI.

Wispr may use Customer Content to train its AI models, but only if the user opts in via a setting ('Improve the model for everyone'); training is not the default described in the text and is user-controllable. Meeting audio is excluded from training unless expressly enabled, and Google User Data is never used for training. The residual risk is that pseudonymized transcripts and corrections can be used once the toggle is enabled.

The privacy policy describes retention in general, purpose-limited terms ('only for as long as is necessary') without concrete retention schedules or a deletion SLA for consumer users. Third-party LLM providers delete shared data within roughly 30 days, and Google data is deleted within a 'commercially reasonable period' after disconnection. The absence of firm timeframes and a clear self-serve deletion mechanism for general account data is a moderate gap.

Wispr shares data with service providers (LLM providers, analytics, cloud, payment), affiliates, and — notably — advertising partners such as LinkedIn for its own marketing. It states it does not sell data. The sharing with advertising networks, while framed as first-party marketing, together with business-transfer and affiliate disclosures broadens the sharing surface beyond what the core dictation service strictly requires.

The policy provides multiple concrete opt-out mechanisms: an in-product toggle for model training, the ability to disable the Context Awareness feature, unsubscribe from marketing, GDPR data-rights requests, and analytics/advertising opt-outs. These are real, disclosed controls rather than vague promises.

The privacy page displays SOC 2 and HIPAA badge images, but the policy body text names no framework, cites no audit report or trust center, and provides no attestation evidence — so these are at best claimed, not evidenced. The documents address GDPR and California rights but are silent on ISO 27001, ISO 42001, NIST CSF, the EU AI Act, and most other baseline frameworks. Badge imagery without substantiating text is a weak compliance signal.

The consumer documents provide no meaningful transparency into model behavior, no explainability commitments, and no enterprise auditing capability. They disclose which third-party LLM providers may be used but say nothing about auditing model decisions or outputs. Silence on this topic is itself a risk signal.

The privacy policy describes generic technical, administrative, and physical safeguards and mentions encrypted on-device meeting audio, but gives no specifics on encryption standards, penetration testing, or incident-response commitments, and explicitly disclaims any guarantee of security. No breach history is disclosed. A SOC 2 badge appears on the page but no trust center or audit report is referenced in the text.

The consumer documents reference paid Services, Authorized Users, and 'Customers (e.g. your employer)' but do not spell out data-handling differences between free and paid tiers. Meaningful enterprise protections (deletion SLA, no-training default, DPA) live in the separate MSA, not in the consumer terms. From the consumer text alone the delta is unclear.

Wispr reserves the right to review user conduct and content for compliance with the Terms, implying possible human access to user content. The policy does not detail safeguards, scope limits, or whether staff can read prompts and meeting transcripts. This reserved right without clear boundaries is a moderate concern for sensitive content.

The policy discloses that Wispr may disclose data to comply with law, court orders, and government/regulatory requests, and to protect its rights. The Terms impose mandatory individual arbitration, a class-action waiver, and a California forum, with a 30-day arbitration opt-out. No active litigation is disclosed. The consent-law risk of recording third parties in meetings is significant and shifted entirely to the user.

Wispr collects a broad set of PII (name, email, phone, IP, device identifiers, usage data) and processes potentially sensitive Meeting Data including audio, communications content, and third-party participant details — which can constitute SPI. It also accesses Gmail/Calendar/Contacts content with granular disclosure. Collection is disclosed with purpose limitation and controls, but the breadth of communications-content processing warrants YELLOW.

Both the Terms and Privacy Policy carry a 'Last Updated: August 19, 2026' date, well within 12 months of the August 2026 analysis date. The policies explicitly address the AI/LLM capabilities the product ships — dictation, Notetaker, third-party LLM providers (OpenAI/Anthropic), model training toggles, and Google integrations — matching the marketing surface.

Three consumer-facing documents were supplied (Terms, Privacy Policy, Affiliate Terms) and they are largely consistent with each other on ownership, training opt-in, third-party LLM handling, and the 30-day provider deletion window. No material contradictions were found across these documents; the affiliate terms govern a distinct relationship and do not conflict with the core user terms.