Privacy Policy

Overview

WhisperARC is a local-first desktop application with an optional cloud transcription mode for paid plans. This policy applies to the WhisperARC website, downloads, desktop app, license services, plan usage, payments, updates, runtime access, security and support.

WhisperARC is the data controller for the personal data described in this policy. For privacy questions, contact WhisperARC at support@whisperarc.app.

Audio and transcripts

Local Mode processes microphone audio, system audio and imported media on your device. Every local feature is available to Free accounts without a usage quota. Transcripts, translations, custom spellings and prompts remain local unless you explicitly choose to share them.

Paid users can explicitly select Cloud. In that mode, the selected audio is sent over HTTPS through WhisperARC's secure broker to a speech-to-text provider. If Cloud translation is enabled, the source transcript is then sent to a separate text model for translation. The broker does not intentionally persist audio or transcripts. It returns the result to the app. WhisperARC retains request duration and quota metadata as needed to enforce the monthly limit and prevent duplicate billing.

You control the files and text you open, create, export, save or share. If you choose to send audio, transcripts, screenshots or files to support, WhisperARC will process that material to answer your request, investigate the issue and keep a support record where needed.

Data WhisperARC may process

To provide licenses and usage limits, WhisperARC may process your license key, plan type, license status, expiry date where applicable, linked device count, activation dates, app version, platform and device identifiers generated by the app.

To run Cloud, WhisperARC may process a pseudonymous license subject, an idempotency identifier, audio duration, monthly quota period, seconds used or remaining and limited request and error metadata. The Cloudflare broker does not store the submitted audio or returned transcript as account history.

To provide updates, runtime access and security controls, WhisperARC may process app version, platform, device identifier, runtime bundle information, signed policy request metadata, installer or update metadata, security event metadata, request timestamps and limited diagnostic status.

For purchases and subscriptions, WhisperARC may process your purchase email, plan, amount, currency, payment status, payment date, checkout session, customer or subscription identifiers, order identifiers, refund status, trial status, renewal or cancellation status, tax or billing metadata provided by the payment provider and related payment provider references. WhisperARC does not store full payment card numbers.

When you contact support, WhisperARC may process your email address, message and any attachments or details you choose to provide, such as device information, app version, Windows version, graphics card model, driver version, screenshots or logs.

Website and technical data

The WhisperARC website uses Umami Cloud to measure page visits and clicks on installer download links. Download events include the button location and app version; they do not confirm a completed download or installation. URL query parameters and fragments are excluded from tracked page URLs, and the tracker respects Do Not Track browser settings. Hosting providers may also process basic technical logs, such as IP address, date, requested page and browser information, to deliver and secure the site.

License, update and security services may process request metadata such as IP address, request time, user agent where available, public API key or client key and limited technical identifiers to prevent abuse, apply rate limits, validate signed policy requests and keep the service reliable.

The website and production license and update service use Sentry's European ingestion region for technical error reports. Reports retain error codes, stack traces, component and release information. Request bodies, cookies, authorization headers, license keys and user identity fields are excluded. Session Replay and performance tracing are disabled for these services.

Local app data

WhisperARC stores app settings locally on your device, such as language preferences, selected audio devices, hotkeys, custom spellings, translation settings, license cache, update state and limited diagnostic logs.

Local diagnostic logs are designed to redact license keys, paths, transcripts, translations, prompts and other user content. WhisperARC does not receive those logs unless you decide to share them for support.

Production builds may also send bounded technical diagnostics to WhisperARC's error monitoring provider when remote diagnostics are configured. These reports may include the app version, build identifier, environment, Windows and Python runtime information, affected component, normalized error code, timing and crash or session status. They are designed not to include audio, transcripts, translations, prompts, clipboard content, license keys, authorization headers, email addresses, local file paths, filenames or HTTP request bodies. Diagnostic ingestion is configured in the European region.

The app may keep encrypted or protected local license, update, runtime and offline-use state so WhisperARC can continue operating during limited offline periods and verify the integrity of local components.

Why data is processed

WhisperARC processes personal data to provide the app, validate licenses, apply the anti-sharing device safety threshold, process payments, deliver updates, answer support requests, provide runtime access, prevent abuse, protect the service, comply with legal obligations and handle disputes, chargebacks or refund requests.

Legal bases

WhisperARC mainly processes data to perform a contract with you, including access to the app, paid plans, licenses, support and updates.

Some data is processed to comply with legal obligations, including accounting, tax, consumer and refund obligations. Some data is processed for legitimate interests, such as security, fraud prevention, abuse prevention, service reliability, signed policy validation, update integrity and defending legal claims.

If WhisperARC later adds optional marketing, non-essential cookies or another feature that requires consent, that processing will rely on your consent and you will be able to withdraw it.

Sharing

WhisperARC does not sell your personal data. WhisperARC may share limited data with service providers that help operate the website, license system, payment processing, cloud transcription, update delivery, runtime access, hosting, email, support, security, accounting, tax, error monitoring or legal compliance. Cloud relies on third-party providers for speech-to-text and optional text translation. Sentry provides bounded technical error monitoring for configured production builds, the website and the production license and update service. Umami Cloud provides website audience measurement.

WhisperARC may also disclose data when required by law, a court order or a public authority request. It may also do so to protect rights, users and the service.

International transfers

Some service providers may process data outside the European Economic Area. When this happens, WhisperARC relies on appropriate safeguards where required, such as adequacy decisions, standard contractual clauses or equivalent protections.

Retention

Local app data stays on your device until you delete it, reset the app or uninstall the app, subject to how Windows keeps application data.

License and device records are kept while needed to provide access, enforce the anti-sharing safety threshold, prevent abuse, support offline access and handle disputes.

Payment, billing and accounting records are kept for the legal periods that apply, including periods required for tax, accounting, payment, refund and dispute records. Support messages are kept as long as needed to answer the request and manage any follow-up.

Security, rate-limit and diagnostic event records are kept for short operational periods unless a longer period is needed for security, fraud prevention, dispute, chargeback, support or legal reasons.

Security

WhisperARC uses practical safeguards to protect personal data, including local protected storage where available, encrypted or protected local state, signed policy validation, installer and runtime integrity checks, limited access, request limits, HTTPS, webhook signature checks and redaction of sensitive diagnostic content.

No system can be guaranteed perfectly secure. If WhisperARC becomes aware of a data breach that creates a legal notification duty, WhisperARC will follow the required notification process.

Cookies

Umami website analytics does not use cookies. The website does not intentionally use advertising or social tracking cookies. If WhisperARC later adds non-essential cookies or similar trackers, WhisperARC will update this policy and request consent where required.

Your rights

Depending on the situation, you may have the right to access, correct, delete, restrict, object to or receive a portable copy of your personal data. You may also have the right to object to certain processing based on legitimate interests. Where processing is based on consent, you may withdraw that consent at any time.

To exercise your rights, contact support@whisperarc.app. You may also lodge a complaint with the data protection authority that applies to you.

Automated decisions

WhisperARC does not use your personal data for advertising profiling. License checks may automatically enable, limit or disable paid features based on your plan, license status, usage limits or the anti-sharing device safety threshold.

Security and abuse-prevention checks may automatically rate-limit, reject or require a fresh validation request when a request appears invalid, expired, excessive or unsafe.

Children

WhisperARC is not directed to children. If you believe a child has provided personal data to WhisperARC, contact support so the request can be reviewed.

Changes to this policy

WhisperARC may update this policy to reflect product, legal or operational changes. The updated version applies from the date shown below, unless a later effective date is stated.