Wispr Flow

Wispr states that users maintain control over model training through a setting, and that third-party LLM providers (OpenAI/Anthropic) do not use data for training. However, the language is vague about Wispr's own training practices. The ToS says 'you maintain control over whether your content can be used to train Wispr's AI models, through a setting' but does not explicitly state that training is disabled by default, only that control exists. The Privacy Policy confirms opt-in/opt-out capability but lacks clarity on default behavior.

“[ToS] 'you maintain control over whether your content can be used to train Wispr's AI models, through a setting provided in the Services' and [Privacy] 'If you choose to share your content with us for model training, we may also use your Customer Content to train our AI models.'”

The ToS grants Wispr a broad, sublicensable license to Customer Content 'for the limited purpose of providing, improving, and protecting the Services.' While the license is nominally limited in purpose, it is worldwide, non-exclusive, royalty-free, and sublicensable, which creates moderate concern. The license does not explicitly terminate upon account deletion, and 'improving the Services' is broad language that could encompass training.

“[ToS] 'you grant Wispr a worldwide, non-exclusive, royalty-free, sublicensable license to access, reproduce, modify, distribute, transmit, export, display, store and otherwise use Customer Content in any and all media now known or later developed for the limited purpose of providing, improving, and protecting the Services.'”

Wispr shares data with service providers (LLM providers, analytics, cloud, communications) under contractual restrictions, and states that third-party LLM data is deleted after 30 days. However, the Privacy Policy mentions sharing with 'affiliates' and 'advertising partners' (LinkedIn, etc.) for advertising purposes, and the scope of affiliate sharing is not clearly limited. Sub-processor lists are not explicitly published, creating moderate concern.

“[Privacy] 'We may disclose Personal Data with Services Providers who are working on our behalf... These service providers are contractually restricted from using Personal Data for any purpose other than providing services to Wispr' and 'We may disclose Personal Data with our affiliates who use Personal Data as set out in this Privacy Policy' and 'we may disclose or otherwise make available Personal Data with them [advertising partners] for this purpose.'”

The Privacy Policy states data is retained 'only for as long as is necessary' and mentions different retention periods depending on data type, but does not specify concrete timeframes for most data categories. Usage Data is retained for 'internal analysis purposes' with vague duration ('generally retained for a shorter period'). No explicit automatic deletion upon account termination is stated, creating moderate concern.

“[Privacy] 'We will retain your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy' and 'We retain your Personal Data for different periods of time depending on what it is, how we use it, and how you configure your settings' and 'Usage Data is generally retained for a shorter period.'”

The ToS explicitly states that the user owns all Output and that Wispr assigns all right, title, and interest in Output to the user. This is a clear, enterprise-friendly protection that gives the company full IP ownership of generated content.

“[ToS] 'you retain all ownership rights in Input and you own all Output, and Wispr hereby assigns to you all of our right, title, and interest, if any, in and to Output.'”

Neither the ToS nor Privacy Policy mentions SOC 2, ISO 27001, HIPAA, or any formal compliance certifications. While the Privacy Policy states that Wispr implements 'technical, administrative and physical safeguards,' no third-party certifications or formal compliance documentation is referenced. No trust page, security documentation, or DPA is mentioned in the provided documents.

“Not found in documents — scored conservatively. [Privacy] states 'We implement technical, administrative and physical safeguards to protect the information we collect' but provides no certification evidence.”