Whisay privacy policy

Last updated: 26 October 2026

This policy explains what data we process when you use the Whisay app, the whisay.com website and the account site account.whisay.com, why we do it and what rights you have.

In short:

Local mode: speech is recognised on your computer. Recordings and texts never reach us, and you do not need an account.
Online mode: the recording goes to our server and to a speech recognition provider. We do not store recordings or dictated texts on the server; we only store usage counters.
History, dictionary, snippets and settings stay on your computer.
You can delete your account yourself, in the app or at account.whisay.com.

1. Data controller

The controller of your personal data is Martez Marcin Szołtysek, Majowa 8, 41-706 Ruda Śląska ("we" or "Whisay").

Personal data matters: support@whisay.com
Everything else: support@whisay.com

We have not appointed a data protection officer. For anything about your data, write to support@whisay.com.

2. How the app works with your data

What leaves your computer depends on the dictation mode you choose in the app. The active mode is shown on the pill with every dictation.

Local mode

Speech is recognised by a model installed on your computer. The recording and the text are not sent to us or to anyone else.
You do not need an account.
The app connects to the internet only when:
- you download the speech recognition model (from our file storage in Microsoft Azure),
- you check for updates. In local mode the app does not check on its own until you turn this on in Settings. A manual "Check now" always works.

Online mode (Whisay cloud)

Online mode (including "Auto" mode, which is the cloud with a local fallback, and Ultra mode, which is live dictation) requires an account. In this mode the app sends to our server api.whisay.com:

the dictation recording (in Ultra mode the audio is streamed as you speak),
the words from your personal dictionary, as a hint for speech recognition,
for Refine (text refining): the dictated text, the kind of Refine you chose, the target language when translating, and your greeting, signature or custom instruction if you set them,
an account token that confirms you may use the cloud.

Our server passes the recording or text to a speech recognition or language model provider (listed under Recipients) and sends the result back to the app. The recording and the text are processed in memory only, for the duration of the request. We do not store them in a database or in logs. We only record usage data: seconds of audio, Refine words, number of requests, amount of data sent and the kind of mode used.

The finished text goes back to the app and is saved in the history on your computer.

Your own key mode

This is an advanced option: you enter the address of a speech recognition service and your own key. The app then sends the recording directly to the service you chose, bypassing our servers. That provider is responsible for that processing under its own terms. Your key stays on your computer and is protected like other secrets (section 3).

3. Data on your computer

The app stores the following in a local database:

dictation history: text, time, mode, recording length, transcription time and the engine used,
audio recordings: only when a transcription failed (so you can retry it) or when you turn on "Always save the audio recording to history" ("Zawsze zapisuj nagranie audio do historii" in the Polish interface; off by default),
text fragments during a dictation: a safety net in case of a crash, removed once the dictation finishes,
text versions after Refine,
personal dictionary and snippets,
settings, including the email address of the signed-in account, the plan name and the last known usage,
the downloaded speech recognition model.

Secrets (the account session token and your own key) are protected by the operating system: DPAPI on Windows, the Keychain on macOS.

The data lives in the app data folder in your user profile:

Windows: %APPDATA%\com.whisay.app
macOS: ~/Library/Application Support/com.whisay.app

We have no access to it. You decide how long to keep it: you can turn on automatic history cleanup (after 30, 90, 180 or 365 days; by default nothing is deleted), delete single entries or wipe everything. The Your data page explains how.

4. Data on our servers

Without an account we keep no data about you on our servers. We only count anonymous events (item k).

With an account we process:

Data	Purpose	Legal basis	Retention
a) Account: email address and its simplified form (for example without dots and plus tags in Gmail), display name (from Google or Microsoft, or part of the email address), the account ID at the sign-in provider, creation date, plan, end of the trial, a Pro plan granted by us and its end date, block status and reason	creating and running the account, sign-in, providing the plan	Art. 6(1)(b) GDPR (contract)	until the account is deleted
b) Sign-in and sessions: one-time email codes (we store only a hash), session tokens (hash only), short-lived sign-in codes	secure sign-in	Art. 6(1)(b) and (f) GDPR (contract, security)	an email code is valid for 10 minutes and usually removed after about 2 hours; app session up to 60 days, account site session up to 30 days; invalid tokens removed after 90 days; everything is removed with the account
c) Usage: monthly account counters: seconds of cloud dictation (also split by mode, including Ultra), Refine words, number of requests, amount of data sent	plan limits, fair use rules, the usage bar in the app, cost accounting	Art. 6(1)(b) and (f) GDPR (contract, abuse prevention)	until the account is deleted
d) Activity: the list of days on which the account sent any request	statistics of active and returning users	Art. 6(1)(f) GDPR (product development)	until the account is deleted
e) Subscription: data from Paddle: subscription and customer IDs in Paddle, status, price, currency, billing period, start, next payment, end and cancellation dates, net amount of the last paid payment. We never receive card details.	providing the paid plan, accounting, revenue statistics	Art. 6(1)(b) and (f) GDPR	for the life of the subscription; after the account is deleted the record stays without a link to the account (the Paddle customer ID remains), for no longer than 5 years from the end of the year in which the subscription ended
f) Trial record: a hash of the email address made with a secret server key (HMAC) plus the dates the trial was granted and ends. No address and no account ID.	the trial is available once per mailbox, also after deleting and re-creating the account	Art. 6(1)(f) GDPR (abuse prevention)	kept after the account is deleted, for as long as we offer a trial
g) Administrator activity log: date, action (for example viewing account details, granting a plan, blocking), account ID, details (for example the reason). Not your email address.	security and accountability for access to data	Art. 6(1)(f) GDPR	2 years
h) Technical logs: errors, limit refusals, results of live dictation sessions, technical codes; they may contain an account ID. No recordings and no texts.	diagnostics, security, running the service	Art. 6(1)(f) GDPR	30 days
i) IP address: processed by our server in memory only, to rate-limit sign-in, the account site, downloads and updates. Our code does not store it in the database or in logs.	abuse prevention	Art. 6(1)(f) GDPR	for the duration of the rate limit (minutes)
j) Correspondence: your address and the content of your message when you write to us	handling requests, complaints and data requests	Art. 6(1)(b), (c) and (f) GDPR	until the matter is closed, then up to 3 years in case of claims
k) Anonymous statistics: downloads per operating system, update checks (system, app version, whether it is the first check today and this month), total cloud minutes, Refine words, number of deleted accounts, daily summaries	product statistics	not personal data: we store no IP address and no installation ID	no time limit

Only the Whisay administrator has access to account data, for example when handling your request or when abuse is suspected. Every view of account details is recorded in the log (item g).

5. Legal bases in short

Contract (Art. 6(1)(b) GDPR): account, sign-in, cloud dictation, Refine, plan and limits.
Legal obligation (Art. 6(1)(c) GDPR): answering complaints and requests, tax and accounting duties.
Legitimate interests (Art. 6(1)(f) GDPR): security, abuse prevention, product statistics, establishing and defending claims.

We do not process data on the basis of consent. An email address is required to create an account; without an account you can use local mode.

6. Websites

whisay.com uses no cookies, no analytics and no tracking pixels. Fonts are served from our own server. The only thing saved in your browser (localStorage) is your language choice. Download buttons go through api.whisay.com, which counts downloads per operating system, without the IP address, and redirects to the installer in our file storage.

account.whisay.com uses only what the account needs to work:

the __Host-whisay_rt cookie (not readable by page scripts), which keeps you signed in, for up to 30 days,
the whisay.external cookie, set while you sign in with Google or Microsoft, valid for 10 minutes,
one-time sign-in data in the browser tab's storage (sessionStorage), removed after use,
your language choice in localStorage.

These are strictly necessary to provide the service you ask for, so we do not ask for consent. When you click to buy a plan, the page loads the Paddle checkout script; from then on Paddle processes data under its own privacy policy.

7. Recipients

We use providers that process data on our behalf (processors) and services of companies that act as separate controllers.

Company	What it does	Data	Where
Microsoft (Azure)	application server, account database, key vault, file storage (installers, models), logs, sending sign-in code emails, website hosting	all data in section 4, recordings and texts while they are processed, email address and sign-in code	West Europe region (Netherlands)
Microsoft (Azure AI Foundry)	speech recognition in Ultra mode	the recording during dictation	resource in the Sweden Central region, global deployment: processing may take place in other Azure regions, including outside the EEA
Groq	speech recognition in standard mode, backup model for Refine	recording, dictionary words, text for Refine	USA
OpenRouter	backup speech recognition, language model for Refine	recording, dictionary words, text for Refine	USA; OpenRouter forwards the request to a model provider of its choice, which also processes the data
Paddle	seller of the subscription (Merchant of Record): payments, invoices, taxes, refunds	account email address, Whisay account ID at purchase; you give payment details directly to Paddle	Paddle is a separate controller of this data
Google, Microsoft, Apple	sign-in, if you choose that method (Apple once it becomes available)	they give us your email address, name and account ID	separate controllers, under their own policies

Providers process data under their contracts with us and their own terms. We do not decide how long they keep data in their own systems; their documents describe that.

We may also disclose data to public authorities where the law requires it.

Transfers outside the EEA

When you use online mode, the recording and the text may reach providers outside the European Economic Area, mainly in the USA. We base such transfers on the standard contractual clauses approved by the European Commission or on a Commission adequacy decision (Articles 45 and 46 GDPR). You can get a copy of the safeguards by writing to support@whisay.com. If you do not want recordings to leave your computer, use local mode.

8. Retention

The retention period for each category is in the table in section 4. In addition:

after an account is deleted, data may remain for a short time in automatic database backups in Microsoft Azure until they are overwritten,
technical logs are removed after 30 days,
you keep the data on your computer for as long as you like.

9. Your rights

You have the right to:

access your data and get a copy (Art. 15 GDPR),
rectification (Art. 16 GDPR),
erasure (Art. 17 GDPR); you can also delete your account yourself without writing to us,
restriction of processing (Art. 18 GDPR),
data portability for data you gave us and that we process under the contract (Art. 20 GDPR),
object to processing based on our legitimate interests (Art. 21 GDPR),
lodge a complaint with the President of the Polish Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl) if you believe we process your data unlawfully. You may also lodge a complaint with the supervisory authority of the EU country where you live or work, or where the infringement took place (Art. 77 GDPR).

Send your request to support@whisay.com, preferably from the address linked to your account. We will reply within one month; for complex requests this may be extended by two more months, and we will tell you if so. We may ask you to confirm your identity.

10. Automated decisions

We do not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you (Art. 22 GDPR). The only automatic mechanisms are those described in the terms of service: plan limits and fair use rules (switching the engine or pausing the cloud until the end of the month), one trial per mailbox and blocking new accounts on disposable email addresses. If you want a person to review such a situation, write to support@whisay.com.

11. Children

You must be at least 16 years old to create a Whisay account. If we learn that a younger person created an account, we will delete it.

12. Security

Connections to our servers are encrypted (TLS). We store sign-in codes and tokens only as hashes. Keys for provider services are kept in Azure Key Vault, never in the app. The admin panel accepts sign-in only through Google or Microsoft, and every view of account details is logged. On your computer, secrets are protected by the operating system (DPAPI or the Keychain).

13. Changes to this policy

We publish the current version on this page with the date of the last change. We will tell you about significant changes by email or in the app before they take effect.

14. Contact

Martez Marcin Szołtysek, Majowa 8, 41-706 Ruda Śląska
Personal data: support@whisay.com
Everything else: support@whisay.com