Your data, kept quiet.

Who we are

The data controller for Whispia is KwypeSoft, a company registered in France. You can reach us, including our Data Protection Officer, at contact@whispia.app. For convenience, all privacy, security, and DPO requests can be sent to that single address — they are routed internally to the right team.

What we collect

We collect only what we need to run the service. Concretely:

We do not collect precise location, contacts, photos, raw microphone audio, or browsing history outside the app. We do not run third-party advertising SDKs.

Microphone access is used only for voice-to-text input on the story-prompt screen. Audio is processed on-device by your operating system's speech recogniser; only the resulting transcript is sent to our AI providers as part of the prompt. Raw audio is never uploaded or retained by us. You can revoke microphone permission at any time from your device settings without losing access to the rest of the app.

Voice samples. When you create a Clone, you upload an audio recording of a voice. This recording is uploaded to our voice-synthesis provider for the sole purpose of training the Clone, and is then discarded by us. We do not retain the recording in our systems by default. The synthesis provider's retention policy applies to the audio they hold for training and synthesis purposes.

Provider API keys (BYOK). If you enable Bring Your Own Keys, the developer API keys you paste are encrypted at rest in your account, used solely to authenticate outbound requests to the corresponding third-party provider on your behalf, and never displayed back to you in clear, exported, logged in plain text, or sold. You can rotate or remove a key at any time from the in-app settings; closure of your Whispia account wipes any stored keys from our systems. Whispia does not revoke the key on the provider side — that remains your responsibility. See Terms §19 for the full BYOK terms.

Children’s data

Children do not have Whispia accounts. There are no child logins and no child sub-accounts. A parent or legal guardian creates learner profiles inside their own adult account, and every profile lives under that account.

A learner profile stores a display name, an age range and an avatar choice — nothing else. We do not ask for a date of birth, an email address, a photograph, or any contact detail for a child. Age ranges are broad bands (roughly 3–6, 6–10, 11–14, and adult), used only to pitch the vocabulary of a lesson or a story. A band is not a birth date.

Learning progress. When a lesson plays, we record which lesson it was and when, attributed to the learner profile that was active. That record powers the progress views in the app — the constellation, the day-by-day calendar and the family view — and the optional weekly recap email. It is not sold, not shared with advertisers, and not used for profiling.

No advertising, no profiling. Whispia shows no advertising, uses no advertising identifiers, and carries out no behavioural profiling of children or of adults.

Parental gate. When a device is set to the focused children’s space, a parental gate stands in front of the account, purchase and content-generation surfaces.

Whispia is a general-audience app with an appropriate content rating. It is not enrolled in the Apple Kids Category or in Google Play’s Designed for Families programme, and should not be described as a certified children’s app.

The account holder must be an adult (16 or over in the EU, 13 or over where local law sets a lower threshold) and is responsible for supervising a child’s use of Whispia. Deleting a learner profile removes that profile and its progress record; closing the account removes everything, as described in Retention and Your rights. You can review, export or delete a profile at any time from the in-app settings, or by writing to contact@whispia.app.

How we use it

• To create and authenticate your account and let it sync across devices.
• To deliver Originals, generate AI stories, and play soundscapes you choose.
• To play lessons from Whispia Learning and keep the progress views (constellation, calendar, family view) and the optional weekly recap email up to date.
• To process subscriptions, token purchases, and renewals.
• To diagnose crashes, measure aggregate stability, and improve the product.
• To send essential service messages (e.g. receipts, security notices). We do not send marketing email unless you opt in.
• To detect and prevent fraud, abuse, or unsafe content.

Legal bases under GDPR

Each processing activity has a lawful basis under Articles 6 and (where relevant) 9 of the GDPR:

• Performance of a contract — running your account, delivering content you requested, processing subscriptions.
• Legitimate interest — security, fraud prevention, basic product analytics on aggregated data. You may object at any time.
• Consent — optional analytics cookies on the website, marketing email opt-in, mood-history retention beyond the default window, the one-time in-app AI-processing consent that gates generation, and the adult account holder’s consent for the learner profiles they create. You can withdraw consent at any time.
• Legal obligation — keeping invoices, responding to lawful requests from authorities.

AI generation and your prompts

When you generate a story, your prompt (mood, theme, length, voice choice, and any free-text input) is sent to one of our AI providers — currently, for text, mainly OpenAI, Mistral AI, and Perplexity; and, for voice synthesis, OpenAI, Azure Speech, Google Gemini, Fish Audio, or ElevenLabs. We require these providers to:

• Process your prompt only to fulfil the request.
• Not use your prompt to train their models, where the provider offers that option, which we enable by default for paid API tiers.
• Delete prompts on a short retention schedule on their side (typically 30 days or less).

Learn mode. When you create a Learn story, the topic you type is sent to our AI providers to research, write, and fact-check it. Alongside the text and voice providers above, we use Perplexity AI to research the subject against real online sources and to help fact-check the finished story. If you choose to include a person's name — or a child's first name and age — in your request so the story can be made about them, that text is part of the prompt and is processed by these providers too. Including a name or an age is entirely optional and at your discretion; Learn mode works without it. Learn-mode prompts follow the same retention as other generation prompts (see Retention).

Whispia Learning. The lessons in the Whispia Learning catalogue are written by AI and fact-checked against public sources using a search-grounded AI provider, the same way a Learn-mode story is; the sources consulted are shown in the app so you can check them yourself. Catalogue lessons are produced ahead of time and are the same for everyone, so listening to one sends no prompt of yours to any provider. Only what you ask for — a Learn-mode topic, or a “Go deeper” request that extends a lesson — is sent for generation, and only after you have given the one-time in-app AI-processing consent that gates every generation feature. You can withdraw that consent at any time from the app’s Privacy & data screen; generation then stops working, and the rest of the app carries on.

If you use Bring Your Own Keys (BYOK), the same prompt is instead sent to the provider you configured, authenticated with your developer API key. In that case, you have a direct contractual relationship with that provider for those requests, and the provider's own privacy policy, retention schedule and training-opt-out controls apply (which may differ from what we negotiate on the standard pipeline). Whispia acts only as a technical relay and does not store the prompt body server-side beyond what is required to dispatch the request, surface the result in your library, and run the safety pipeline described in Terms §19.

Listen links

You can turn any piece of your Whispia audio into a listen link — a link or a QR code that plays that one item in any web browser.

• The link is the credential. Anyone holding it can play that audio. No Whispia account is created for the listener, no sign-in is asked for, and no listener profile is built.
• You stay in control. Links expire, carry a daily play limit, and can be revoked by their owner at any time from the app. Revoking takes effect immediately.
• Request metadata such as the IP address of the browser playing the audio is processed transiently, for abuse prevention and rate limiting only. It is not attached to a profile and not used to build one.
• Sharing is your decision. The person who creates a link is responsible for who they give it to.

Sub-processors and sharing

We share the minimum data each provider needs to do its job. We do not sell personal data, ever.

Each sub-processor is bound by a written data-processing agreement consistent with Article 28 GDPR. The current list is maintained and may be updated; material changes are announced at least 14 days before they take effect.

BYOK requests. When you use Bring Your Own Keys, requests for the corresponding capability are authenticated with your own developer key and routed to the provider directly through your account. For those specific requests, the provider acts as your processor under your direct agreement with them, not as our sub-processor. Whispia's sub-processor list above continues to apply to all other requests and to the Whispia-side overhead (orchestration, moderation, audit logging) that wraps a BYOK call. See Terms §19 for the full allocation of responsibilities.

International transfers

Some of our sub-processors are based in the United States. Where personal data leaves the European Economic Area we rely on the European Commission's Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework. Supplementary measures (encryption in transit, minimisation, short retention) are applied to reduce risk.

How long we keep things

• Account & subscription — for as long as your account exists, then deleted within 30 days of closure (longer where law requires, e.g. invoices kept for 10 years in France).
• Generation prompts — stored alongside the generated audio; they stay in your library for as long as your account is active and follow the same deletion lifecycle as the story they belong to.
• Generated stories and audio — kept in your library for as long as your account is active. When you delete a story, or when you close your account (which deletes all your stories at once), the data is removed within 30 days. Free-tier accounts are subject to a storage cap; when the cap is reached, the oldest items are automatically removed to make room for new generations.
• Learner profiles & learning progress — kept for as long as the profile exists. Deleting a profile removes it and its progress record; closing the account removes every profile at once, within 30 days.
• Listen links — a link stops working at its expiry date, or immediately when you revoke it. The request metadata used for rate limiting and abuse prevention is transient and is never attached to a listener profile.
• Mood entries — kept by default for 12 months; you may extend, shorten, or wipe them at any time.
• Provider API keys (BYOK) — kept (encrypted) for as long as you keep them configured; deleted from our systems immediately when you remove the key in-app and within 30 days of account closure. Provider-side revocation remains your responsibility.
• Diagnostic logs — 90 days, aggregated thereafter.

Your rights under GDPR

You have the right to access, correct, delete, restrict, or object to the processing of your data, and to data portability. You can exercise most of these directly from the app's Privacy & data screen, or by writing to contact@whispia.app. We respond within 30 days.

If you believe we have mishandled your data, you may lodge a complaint with the French data-protection authority, the CNIL, or with the supervisory authority in your country of residence.

Security

We use industry-standard practices: encryption in transit (TLS 1.2+), encryption at rest for sensitive fields, access controls, regular dependency updates, and isolated environments. No system is perfectly secure. If we ever suffer a breach affecting your data we will notify you and the CNIL within 72 hours of becoming aware, as required by Article 33 GDPR.

Changes to this policy

We may update this policy as the product, the law, or our sub-processors change. We will post the new version on this page with a revised effective date. For material changes, we will notify you in-app or by email at least 14 days before they take effect, so that you can review and, if you wish, close your account before the change applies to you.

Contact and DPO

Privacy questions, rights requests, and DPO contact: contact@whispia.app. Postal correspondence: KwypeSoft — Whispia Privacy, France. We will route your message internally to the right team.