Privacy Policy
Last Updated: 19 October 2026
WhisperTranscribe B.V. (“WhisperTranscribe“, ”we“, ”us“ or ”our“) operates the WhisperTranscribe desktop application for Windows and Mac and the website whispertranscribe.com (together, the ”Service“). This Privacy Policy explains what information we collect, how we use it, who we share it with, and the choices you have.
We are a company registered in the Netherlands and serve users worldwide. By using the Service, you acknowledge that your information is handled as described in this Privacy Policy. If you do not agree with it, please do not use the Service.
1. Our Privacy Approach in Short
Your transcripts live on your device. We do not store your transcripts, AI-generated outputs, chat history or embeddings on our servers. They are stored locally on your device.
Audio is deleted automatically. Audio and video files you upload are deleted from our servers within minutes of processing.
No training on your content. We do not use your content to train AI models, and our AI and transcription providers are contractually restricted from doing so.
We don’t sell your data. We do not sell, rent or trade your personal information, and we do not build advertising profiles about you.
2. Information We Collect
2.1 Information You Provide
Account information
Email address: required to create your account and sign in.
User role: the category you select during onboarding (for example podcaster, YouTuber, researcher).
Authentication: we use one-time email verification codes. We do not use or store passwords.
Content and communications
Audio and video files you upload for transcription (see Section 3).
Text you submit to AI features, such as prompts or questions about your transcripts (see Section 3).
Customer support information you provide when contacting us.
Feedback, such as beta feature feedback and cancellation reasons.
Correspondence, such as emails you send us.
2.2 Information Collected Automatically
In the desktop app
Device information: operating system (Windows or Mac), operating system version and processor architecture.
App information: application version and distribution channel (standard, Setapp or on-premise).
Usage data: credits used, feature interactions, screens viewed and file metadata (such as upload date and file size).
Error logs: technical logs and crash reports linked to your account ID and user ID. Transcript content is removed from logs.
Approximate location: country-level location, derived from your IP address when an event reaches our analytics provider. The IP address itself is not stored.
We use PostHog, hosted in the European Union, for app analytics. In the app, PostHog stores an analytics profile in local application storage on your device. When you are signed in, that profile is linked to your user ID and account ID, together with your plan type and account role level, so that we can understand how features are used and diagnose errors.
Our analytics provider never stores your name, email address or IP address. Analytics data holds only an account identifier. The record connecting that identifier to your email address is kept separately in our own database.
On our website
We use PostHog in cookieless mode on our website. It sets no cookies, stores nothing on your device and does not assign you a persistent identifier.
How visitors are counted: PostHog derives a temporary identifier on its servers from your IP address, your browser’s user agent and a secret value that rotates every day and is then deleted. A returning visitor cannot be recognised from one day to the next.
Your IP address is not kept. It is used only to derive the daily identifier and is discarded immediately.
What is recorded: pages viewed, clicks on links and buttons, the referring website, browser and operating system, screen and window size, browser language and time zone.
2.3 Advertising Measurement (Website)
We advertise on Google Ads and Microsoft Advertising. To find out which campaigns bring us customers:
When you arrive from one of our ads and then click a download or purchase link, we store your campaign information in your browser’s local storage for 90 days. This includes the click identifier assigned by Google or Microsoft, the campaign parameters in the link, the page you were on and the time.
When you download the app, our servers send that click identifier to Google Ads and Microsoft Advertising so the download can be matched to the campaign.
If you buy a subscription or credit package, we send the click identifier again together with an estimated customer value.
We place no advertising tags, pixels or scripts on our website. All of this is sent from our own servers. We never send your name, your email address or anything you have transcribed.
2.4 Affiliate Tracking (Website)
If you reach our website through an affiliate or partner link, our affiliate platform Tolt stores a referral code in two cookies on your device for 30 days, so the partner who referred you is credited if you make a purchase. Tolt receives the referral code, the page you landed on and the referring website.
2.5 Payment Information
Payments are processed by Stripe. Subscriptions created before our migration to Stripe continue to be billed through LemonSqueezy. We never access or store your full card details. Please see Stripe’s and LemonSqueezy’s privacy policies for how they handle payment data.
3. How Your Content Is Processed
3.1 Transcription
When you transcribe a file, the audio or video is uploaded to our servers in Frankfurt, Germany, and sent to one of our transcription providers (AssemblyAI or Soniox). We may use either provider depending on your account and on model performance. Both process your content within the European Union.
The finished transcript is returned to your device and stored only on your device. The audio or video file is automatically deleted from our servers within 3–10 minutes after processing.
3.2 AI Features
When you use AI features (for example summaries, show notes, social posts, blog posts or chat with your transcripts), the relevant transcript text and your instructions are sent to an AI model provider. The result is returned to your device and stored only on your device. We do not store transcripts, AI outputs, chat history or embeddings on our servers.
To keep the Service reliable, requests are routed to a primary provider, with automatic fallback providers if the primary provider is unavailable. Which providers are used depends on your processing region (see Section 3.3).
3.3 Processing Regions
Standard processing (default)
Transcription: within the European Union.
AI features: primarily Google Cloud Vertex AI using its global endpoint. Fallbacks are the Google Gemini API and then Mistral AI (EU). Google may process requests sent through the global endpoint or the Gemini API in any country where it operates data centres, including the United States.
EU processing (available on request)
Transcription: within the European Union.
AI features: Google Cloud Vertex AI using EU-only endpoints, with Mistral AI (EU) as fallback. Content stays within the European Union.
To request EU processing, contact support@whispertranscribe.com.
3.4 No Training on Your Content
We do not use your audio, transcripts or AI-generated outputs to train AI models. Our AI and transcription providers are contractually restricted from using your content to train or improve their models.
3.5 Temporary Copies Held by Our Providers
We do not keep your content after processing. To provide the Service, our providers may temporarily hold limited copies of it:
Short-term caching to speed up processing, generally deleted within 24 hours.
Safety and abuse-monitoring logs, used solely to detect misuse and meet legal obligations, generally deleted within 60 days.
Transient processing copies held by transcription providers until processing completes and deletion is triggered.
These copies are not used for training and are deleted automatically.
3.6 Content About Other People
Recordings you upload may contain the voices or personal information of other people, such as podcast guests, interviewees or meeting participants. For this content, we process the data on your behalf and according to your instructions, solely to provide the Service to you.
You are responsible for having the right to upload and process such recordings and, where required by law, for informing the people involved or obtaining their consent. If someone asks us about content you uploaded, we will refer them to you where appropriate. Because we do not store transcripts or audio after processing, we usually hold no such content.
4. How We Use Your Information
Providing the Service
Authenticate you with email verification codes.
Transcribe your files and generate AI outputs.
Track and manage your usage credits.
Provide customer support.
Communication
Send transactional emails, such as verification codes and service notices.
Send onboarding emails.
Send marketing emails, with your consent where required, with an easy way to unsubscribe.
Respond to your inquiries and feedback.
Analytics and improvement
Analyse usage patterns and feature interactions.
Diagnose technical issues using error logs.
Improve the performance and features of the Service.
Measure which advertising campaigns and affiliate partners bring us customers.
Security and legal
Keep the Service secure and prevent fraud and abuse.
Comply with applicable laws and respond to valid legal requests.
5. Service Providers
We work with the providers below to operate the Service. Each processes personal data only as needed for its function and under a data processing agreement or equivalent terms.
Provider
Purpose
Location
OVHcloud
Server infrastructure
Frankfurt, Germany (EU)
AssemblyAI
Audio transcription
EU (Ireland)
Soniox
Audio transcription
EU
Google Cloud (Vertex AI)
AI features (primary provider)
Global or EU, depending on processing region
Google (Gemini API)
AI features (fallback)
Global, including the United States
Mistral AI
AI features (fallback)
EU (France)
Stripe
Payment processing
EU (Ireland) / United States
LemonSqueezy
Payment processing for legacy subscriptions
United States
MailerLite
Email delivery and marketing
EU (Lithuania)
PostHog
App and website analytics
EU (Frankfurt)
Framer
Website hosting
Global
Tolt
Affiliate referral tracking
United States
Senja
Testimonial display on our website
Global
Cookiebot (Usercentrics)
Cookie consent management
EU
We may replace or add providers that perform similar functions. When we do, we will update this list.
6. Sharing and Disclosure
We do not sell, rent or trade your personal information.
6.1 Advertising Platforms
We do not use advertising networks to track you, and we place no advertising tags, tracking pixels, retargeting scripts or device fingerprinting on our website or in our app.
To measure our own campaigns, we send Google Ads and Microsoft Advertising a record of app downloads and purchases that began with a click on one of our ads. That record contains:
the click identifier the platform assigned to that click;
the time of the download or purchase;
for purchases, an estimated value.
It never contains your name, your email address or any content you have processed with the Service. We do not share data with data brokers.
6.2 Legal Requirements
We may disclose information where required by law, or where necessary to:
protect our rights, property or safety, or that of others;
detect, prevent or address fraud, security or technical issues;
respond to valid requests from public authorities.
6.3 Business Transfers
If we are involved in a merger, acquisition or sale of assets, your information may be transferred as part of that transaction. We will inform you as required by applicable law.
7. Data Retention
Data
Retention
Account information
While your account is active
Audio and video files
Automatically deleted 3–10 minutes after processing
Transcripts, AI outputs and chat history
Not stored on our servers; stored only on your device
Provider caches and abuse-monitoring logs
See Section 3.5
Usage data and file metadata
While your account is active
Analytics data (app and website)
7 years. App analytics contain only an account identifier; website analytics contain no identifier for you. Neither contains your name, email address or IP address.
Error logs
7 years, alongside the analytics data they are recorded with. Transcript content is removed from logs.
Advertising measurement (browser storage)
90 days
Affiliate referral cookies
30 days
Cookie consent record
12 months
Feedback
Until account deletion
Email suppression list
Indefinitely, to honour unsubscribe requests
Account deletion: when you ask us to delete your account, we delete your personal data within 24 hours. The exceptions are:
email addresses on our suppression list;
data our payment providers must keep for legal, tax and anti-fraud purposes;
analytics data, which is not linked to your email address once your account record is deleted.
8. Data Security
We use appropriate technical and organisational measures to protect your information, including:
One-time email verification codes (no passwords stored).
Encryption in transit (TLS 1.2 or higher) and at rest (AES-256).
Hosting in secure European data centres (OVHcloud, Frankfurt).
Multi-factor authentication on administrative accounts.
Access controls on a need-to-know basis.
Automated code and dependency scanning.
Automatic deletion of uploaded files after processing.
Contractual restrictions on our AI providers against training on your content.
No method of transmission or storage is completely secure, but we work to protect your information and to respond promptly to any security incident.
9. Cookies and Similar Technologies
Our website uses a small number of cookies and browser storage entries.
Strictly necessary
CookieConsent (Cookiebot): remembers your cookie choices. Cookie, 12 months.
Marketing
tolt_referral and tolt_data (Tolt): an affiliate referral code so that a partner who referred you is credited. Cookies, 30 days.
wt_attr: advertising campaign information, including the click identifier assigned by Google or Microsoft, used to measure our own campaigns. Browser local storage, 90 days.
Whether we ask you first depends on where you are
European Economic Area, United Kingdom and Switzerland: we show a cookie banner when you first arrive. Nothing in the marketing category is stored until you accept. You can change or withdraw your choice at any time using the privacy icon on our website.
Other countries: we do not show a banner, and these entries are stored without a prompt, as local law permits. You can remove them at any time by clearing your browser’s site data for whispertranscribe.com.
What we store regardless of your choice
Website analytics run in cookieless mode. They set no cookies and store nothing on your device.
Our testimonial widget is embedded from Senja inside a restricted frame that cannot store anything on your device. Senja’s servers receive your IP address to deliver that content, like any provider hosting an image or font.
In the desktop app
The app stores analytics data in its local application storage on your device, linked to your account, as described in Section 2.2.
10. International Data Transfers
Our servers are located in Frankfurt, Germany, and our analytics are hosted in the European Union. If you use the Service from outside the EU, your data will be transferred to the EU.
Some of our providers are established in, or process data in, countries outside the European Economic Area, including the United States. This includes Google (for AI features under standard processing), Stripe, LemonSqueezy, Tolt and Microsoft. Where personal data is transferred outside the EEA, we rely on:
the European Commission’s adequacy decision for the EU-US Data Privacy Framework, where the provider is certified under it; or
Standard Contractual Clauses approved by the European Commission (with the UK Addendum and Swiss adaptations where relevant).
If you require your content to stay within the EU, you can request EU processing (see Section 3.3).
11. Legal Basis for Processing (EEA, UK and Switzerland)
We process your personal data on the following legal bases:
Performance of a contract: to provide the Service you have requested, including transcription and AI features.
Consent: for marketing emails and for the non-essential cookies and browser storage described in Section 9. You can withdraw consent at any time.
Legitimate interests: for analytics, service improvement, security, fraud prevention and measuring our own advertising.
Legal obligations: where processing is required by law, for example for tax and accounting.
12. Your Rights and Choices
12.1 Accessing and Managing Your Information
To access, correct or delete your information, contact us at support@whispertranscribe.com. We respond within one month. Where a request is complex, this may be extended as permitted by law, and we will tell you if so.
Because your transcripts and AI outputs are stored only on your device, you can view and delete them directly in the app.
12.2 Email Communications
Marketing emails: unsubscribe using the link at the bottom of any marketing email.
Transactional emails: these are required to operate the Service (for example verification codes and important notices).
Suppression list: we keep a list of unsubscribed email addresses so that we continue to honour your choice.
12.3 Cookie and Storage Consent
If you are in the EEA, the UK or Switzerland, you can change or withdraw your consent at any time using the privacy icon on our website. This removes the affiliate referral cookies and advertising measurement data held in your browser, and stops new ones being stored. Elsewhere, you can remove the same information by clearing your browser’s site data for whispertranscribe.com.
12.4 Rights Under GDPR (EEA, UK and Switzerland)
You have the right to:
Access: request a copy of your personal data.
Rectification: have inaccurate data corrected.
Erasure: have your data deleted.
Restriction: limit how we process your data.
Portability: receive your data in a structured, machine-readable format.
Object: object to processing based on legitimate interests.
Withdraw consent: at any time, without affecting earlier processing.
We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing.
12.5 California (CCPA/CPRA) Rights
California residents have the right to:
know what personal information we collect, use and disclose;
request deletion or correction of personal information;
opt out of the sale or sharing of personal information (we do not sell or share personal information for cross-context behavioural advertising);
not be discriminated against for exercising these rights.
To exercise any of these rights, email support@whispertranscribe.com.
13. Children’s Privacy
The Service is intended for users aged 18 and over and is not directed at children. We do not knowingly collect personal information from anyone under 18. If we learn that we have, we will delete it promptly. Parents or guardians who believe we hold such information should contact us at support@whispertranscribe.com.
14. Data Protection Compliance
We maintain records of our processing activities as required under Article 30 GDPR. As a small company, we are not required to appoint a Data Protection Officer, but we have designated team members responsible for privacy compliance.
15. Changes to This Privacy Policy
We may update this Privacy Policy from time to time, for example when we change providers or features. When we do, we will update the “Last Updated” date above. For material changes, we will notify you by email or within the Service. Your continued use of the Service after the changes take effect means you accept the updated Privacy Policy.
16. Contact
For questions, concerns or requests about this Privacy Policy, contact us at support@whispertranscribe.com.
Data controller
WhisperTranscribe B.V.
Bergselaan 233B
3038CB Rotterdam
The Netherlands
KvK (Chamber of Commerce): 92149995
VAT number: NL865906075B01
If you are in the EEA, you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or with the supervisory authority in your country.
This Privacy Policy is effective as of 19 October 2026 and supersedes all previous versions.
