Your data, kept quiet.

Who we are

The data controller for Whispia is KwypeSoft, a company registered in France. You can reach us, including our Data Protection Officer, at contact@whispia.app. For convenience, all privacy, security, and DPO requests can be sent to that single address — they are routed internally to the right team.

What we collect

We collect only what we need to run the service. Concretely:

We do not collect precise location, contacts, photos, raw microphone audio, or browsing history outside the app. We do not run third-party advertising SDKs.

Health tags. A mood entry can carry optional “health” tags. These are health data, a special category under Article 9 GDPR, so a health tag is stored only after you have given your explicit consent in the app. You can withdraw that consent at any time in the app’s Settings: no new health tag is stored after that, and the health tags already stored are erased.

Microphone access is used only for voice-to-text input on the story-prompt screen. Audio is processed on-device by your operating system's speech recogniser; only the resulting transcript is sent to our AI providers as part of the prompt. Raw audio is never uploaded or retained by us. You can revoke microphone permission at any time from your device settings without losing access to the rest of the app.

Voice samples. When you create a Clone, you upload an audio recording of a voice. This recording is uploaded to our voice-synthesis provider for the sole purpose of training the Clone, and is then discarded by us. We do not retain the recording in our systems by default. The synthesis provider's retention policy applies to the audio they hold for training and synthesis purposes.

Provider API keys (BYOK). If you enable Bring Your Own Keys, the developer API keys you paste are encrypted at rest in your account, used solely to authenticate outbound requests to the corresponding third-party provider on your behalf, and never displayed back to you in clear, exported, logged in plain text, or sold. You can rotate or remove a key at any time from the in-app settings; closure of your Whispia account wipes any stored keys from our systems. Whispia does not revoke the key on the provider side — that remains your responsibility. See Terms §19 for the full BYOK terms.

Children’s data

Whispia is two apps that share one account: Whispia Relax, for relaxation, and Whispia Knowledge, for learning. The account holder must be at least 16 years old (or the minimum digital-consent age in their country, where lower), as set out in the Terms. Younger children never have an account: they listen through learner profiles in Whispia Knowledge.

Whispia Relax

Whispia Relax is for adults. It is not directed at children.

Whispia Knowledge

Whispia Knowledge is designed for adults and for the children who listen with them.

Learner profiles, not accounts. Children use Whispia Knowledge through optional learner profiles that the account holder creates and manages inside their own account. A child who listens through a learner profile has no account, no email address and no password.

What a learner profile stores. Only a display name (a nickname or an initial is enough), an age band and an avatar. An age band is a range, such as 6–10 or 11–14, used to pitch the vocabulary of a lesson or a story and to choose which courses that profile is offered; it is never a date of birth. We do not ask for a child’s date of birth, contact details or photo.

What is linked to a learner profile. Its listening activity — which lessons and courses were played, when, and the progress made — and the learning stories created while that profile is active. Listening activity is used only to show that learner’s progress, calendar and constellation: in the app, in the family view, and in the optional weekly recap email sent to the account holder.

Your role and consent. The account holder creates each learner profile and, by doing so, consents to this processing on the child’s behalf, as the holder of parental responsibility or with that holder’s consent (Article 8 GDPR; in France, the age of digital consent is 15). While a learner profile is active, a parental gate stands in front of the account, profile management, the family view, the subscription and purchases, and content generation. You remain responsible for supervising a child’s use of Whispia.

No advertising, no tracking. Whispia shows no advertising, contains no advertising SDK and uses no advertising identifiers. There is no tracking for advertising or marketing, and no behavioural profiling of children or of adults. Learner-profile data is never sold and never used for advertising.

Removing a profile, and erasure. Removing a learner profile removes it from the app at once, and its data — display name, age band, avatar and listening history — is erased within 30 days. Learning stories created while it was active stay in your library, with the age band they were written for but no link to the profile. Weekly recap emails already sent, which show the profile’s display name, are not recalled: our email-sending provider keeps its copies under its own retention policy. Deleting the account also deletes every learner profile and its data; the records we keep after an account is deleted are listed in Retention.

The child’s rights. The account holder exercises the child’s rights — access, correction, erasure and objection — by writing to privacy@whispia.app. The right to complain to the CNIL is set out in Your rights.

How we use it

• To create and authenticate your account and let it sync across devices.
• To deliver Originals, generate AI stories, and play soundscapes you choose.
• To play lessons from Whispia Knowledge and keep the progress views (constellation, calendar, family view) and the optional weekly recap email up to date.
• To process subscriptions, token purchases, and renewals.
• To diagnose crashes, measure aggregate stability, and improve the product.
• To send essential service messages (e.g. receipts, security notices). We do not send marketing email unless you opt in.
• To answer your feedback and support requests.
• Before the public launch, we used sign-up data to run the early-access list on this website and send its emails.
• To detect and prevent fraud, abuse, or unsafe content.

Legal bases under GDPR

Each processing activity has a lawful basis under Articles 6 and (where relevant) 9 of the GDPR:

• Performance of a contract — running your account, delivering content you requested, processing subscriptions, answering your feedback and support requests.
• Legitimate interest — security, fraud prevention, basic product analytics on aggregated data, diagnosing crashes and errors (the apps’ crash reports, which you can turn off in Settings, and our server error records, both linked to your account ID), keeping server logs to investigate errors and security incidents, recording where a password-reset request came from and keeping that record for early-access requests made before the public launch, keeping billing evidence so we can reconcile our accounts, prove a store charge or answer a claim about one, and keeping a record of the emails we sent you and of the changes our staff make to accounts. You may object at any time; we then stop unless we have compelling legitimate grounds, or need the data to establish, exercise or defend legal claims.
• Consent — optional analytics cookies on the website, marketing email opt-in, the early-access programme emails we sent before the public launch, the one-time in-app AI-processing consent that gates generation, your consent to creating a cloned voice, the account holder’s consent for the learner profiles they create, and your explicit consent (Article 9(2)(a) GDPR) to storing optional health tags. You can withdraw consent at any time.
• Legal obligation — keeping the proof that we carried out an account deletion or honoured a consent choice, and responding to lawful requests from authorities.

AI generation and your prompts

When you generate a story, your prompt (mood, theme, length, voice choice, and any free-text input) is sent to one of our AI providers — currently, for text, mainly OpenAI, Mistral AI, and Perplexity; and, for voice synthesis, OpenAI, Azure Speech, Google Gemini, Fish Audio, or ElevenLabs. We require these providers to:

• Process your prompt only to fulfil the request.
• Not use your prompt to train their models, where the provider offers that option, which we enable by default for paid API tiers.
• Delete prompts on a short retention schedule on their side (typically 30 days or less).

Learn mode. When you create a Learn story, the topic you type is sent to our AI providers to research, write, and fact-check it. Alongside the text and voice providers above, we use Perplexity AI to research the subject against real online sources and to help fact-check the finished story. If you choose to include a person's name — or a child's first name and age — in your request so the story can be made about them, that text is part of the prompt and is processed by these providers too. Including a name or an age is entirely optional and at your discretion; Learn mode works without it. Learn-mode prompts follow the same retention as other generation prompts (see Retention).

Whispia Knowledge. The lessons in the Whispia Knowledge catalogue are written by AI and fact-checked against public sources using a search-grounded AI provider, the same way a Learn-mode story is; the sources consulted are shown in the app so you can check them yourself. Catalogue lessons are produced ahead of time and are the same for everyone, so listening to one sends no prompt of yours to any provider. Only what you ask for — a Learn-mode topic, or a “Go deeper” request that extends a lesson — is sent for generation, and only after you have given the one-time in-app AI-processing consent that gates every generation feature. That consent is stored on your phone. You can withdraw it at any time with Settings → Storage → Clear All Data or by signing out; the app then asks for it again before any new generation, and the rest of the app carries on.

If you use Bring Your Own Keys (BYOK), the same prompt is instead sent to the provider you configured, authenticated with your developer API key. In that case, you have a direct contractual relationship with that provider for those requests, and the provider's own privacy policy, retention schedule and training-opt-out controls apply (which may differ from what we negotiate on the standard pipeline). Whispia acts as a technical relay and runs the safety pipeline described in Terms §19. The request itself is stored like any other generation request, as described in Retention: its text is removed within 30 days of the request.

Listen links

You can turn any piece of your Whispia audio into a listen link — a link or a QR code that plays that one item in any web browser.

• The link is the credential. Anyone holding it can play that audio. No Whispia account is created for the listener, no sign-in is asked for, and no listener profile is built.
• You stay in control. Links expire, carry a daily play limit, and can be revoked by their owner at any time from the app. Revoking takes effect immediately.
• Request metadata such as the IP address of the browser playing the audio is processed transiently, for abuse prevention and rate limiting only. It is not attached to a profile and not used to build one.
• Sharing is your decision. The person who creates a link is responsible for who they give it to.

Sub-processors and sharing

We share the minimum data each provider needs to do its job. We do not sell personal data, ever.

Each sub-processor is bound by a written data-processing agreement consistent with Article 28 GDPR. The current list is maintained and may be updated; material changes are announced at least 14 days before they take effect.

BYOK requests. When you use Bring Your Own Keys, requests for the corresponding capability are authenticated with your own developer key and routed to the provider directly through your account. For those specific requests, the provider acts as your processor under your direct agreement with them, not as our sub-processor. Whispia's sub-processor list above continues to apply to all other requests and to the Whispia-side overhead (orchestration, moderation, audit logging) that wraps a BYOK call. See Terms §19 for the full allocation of responsibilities.

International transfers

Some of our sub-processors are based in the United States. Where personal data leaves the European Economic Area we rely on the European Commission's Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework. Supplementary measures (encryption in transit, minimisation and, where the provider allows it, short retention) are applied to reduce risk.

How long we keep things

• Account & subscription — for as long as your account exists, then deleted within 30 days of closure, together with your subscription record and your credit history, except the records listed under “After your account is deleted” below.
• Generation prompts — the text of your request (including a Learn-mode or journey topic, and any name or age you included) is removed within 30 days of the request, whether or not you keep the story. A journey’s plan, which restates your topic, is cleared on the same schedule once the journey is completed or cancelled; until then it is kept, so that you can still approve the journey or redo a failed part. If you have your own text narrated as a story, that text is the story itself and stays with it. The rest of the generation record — the settings you chose, such as length, voice, language, the grammatical form used to address you and the age band a learning story was written for (with no link to a removed learner profile); the title and teaser of a journey part; and the usage the generation consumed — is kept until your account is deleted, even if you delete the story. Deleting a journey deletes its generation records with it.
• Generated stories and audio — kept in your library for as long as your account is active. When you delete a story, or when you close your account (which deletes all your stories at once), the story and its audio are removed within 30 days. Free-tier accounts are subject to a storage cap; when the cap is reached, the oldest items are automatically removed to make room for new generations.
• Learner profiles & learning progress — removing a profile removes it from the app at once and erases its data (display name, age band, avatar and listening history) within 30 days; weekly recap emails already sent are not recalled. Closing the account erases every profile at once, within 30 days.
• Listening activity — kept until your account is deleted. A learner profile’s listening history is erased when the profile is removed, as described above.
• Listen links — a link stops working at its expiry date, or immediately when you revoke it. The request metadata used for rate limiting and abuse prevention is transient and is never attached to a listener profile.
• Mood entries — kept until you delete them: you can reset all your moods in the Settings of Whispia Relax, or delete your account. Health tags are also erased as soon as you withdraw your consent to them.
• Provider API keys (BYOK) — kept (encrypted) for as long as you keep them configured; deleted from our systems immediately when you remove the key in-app and within 30 days of account closure. Provider-side revocation remains your responsibility.
• Consent records — kept until your account is deleted, including after you withdraw the health-tag consent or delete a cloned voice, so that we can show what you agreed to and when. A deleted cloned voice also keeps its name and description until then.
• Feedback & support messages — feedback you send in the app is kept until your account is deleted. The emails you send us, and our team’s notifications about your feedback, are kept as described under “Copies of emails” below.
• Past early-access sign-up — if you joined the list before the public launch, the record is kept until you ask us to delete it, whether or not you later create or delete an account. No fixed end date is set yet.
• Diagnostics and errors — crash and error reports from the apps are deleted after 90 days. Server error records that mention your account ID are deleted once that error has not happened again for 30 days. Our server logs can also contain your email address or account ID; they are kept for as long as they are needed to investigate errors and security incidents, and no fixed period is set for them yet.

After your account is deleted. Deleting your account deletes your data within 30 days, except for the following records:

• The record of the deletion — kept as proof that the deletion was carried out. Your email address and name are removed from it after 365 days; your former account ID and a count of what was deleted stay. An archive of your account data, which we hold and you do not receive, is destroyed about 30 days after the deletion.
• Billing evidence — a log of every store billing event (such as a purchase, renewal, cancellation, expiry or plan change: product, dates and an ID linked to your account), and a record of what each generation you ran cost us and the credits it used, with no name or email address. Kept for as long as they are needed to reconcile our accounts, prove a store charge or answer a claim about one; no fixed end date is set yet.
• Copies of emails — our log of the emails we sent you (your email address, name and the subject), the copies kept by our email-sending provider, the notifications our team received about you (for example for a sign-up, a piece of feedback you sent or an error affecting your account), and any email you sent us. Kept for as long as they are needed to show what we sent you and to follow up on your messages; no fixed end date is set yet.
• Our team’s records — a log of the changes our staff made to your account, such as credits granted, a plan change or a scheduled deletion (it can include your email address), and internal billing alerts that mention your account ID. Kept for as long as they are needed to investigate a dispute or a security incident; no fixed end date is set yet.
• Past early-access sign-up — if you joined the early-access list on this website before the public launch, your name, email address, IP address and browser details, as described above.
• Diagnostics and errors — as described above.
• Content you shared — copies of your stories, journeys, playlists or sound mixes that other people added to their library stay theirs.
• Services we work with — the app stores and RevenueCat keep your purchase history, Apple or Google keep your sign-in authorization, and the AI providers keep the text sent to them, under their own retention policies. We ask our voice provider to delete your cloned voices.

Your rights under GDPR

You have the right to access, correct, delete, restrict, or object to the processing of your data, and to data portability. You can exercise some of them directly in the app (for example by deleting stories or other items, resetting your moods, withdrawing the health-tag consent or deleting your account), and all of them by writing to contact@whispia.app. We respond within 30 days.

If you believe we have mishandled your data, you may lodge a complaint with the French data-protection authority, the CNIL, or with the supervisory authority in your country of residence.

Security

We use industry-standard practices: encryption in transit (TLS 1.2+), encryption at rest for sensitive fields, access controls, regular dependency updates, and isolated environments. No system is perfectly secure. If we ever suffer a breach affecting your data we will notify you and the CNIL within 72 hours of becoming aware, as required by Article 33 GDPR.

Changes to this policy

We may update this policy as the product, the law, or our sub-processors change. We will post the new version on this page with a revised effective date. For material changes, we will notify you in-app or by email at least 14 days before they take effect, so that you can review and, if you wish, close your account before the change applies to you.

Contact and DPO

Privacy questions, rights requests, and DPO contact: contact@whispia.app. Postal correspondence: KwypeSoft — Whispia Privacy, France. We will route your message internally to the right team.