Legal

Privacy / Québec Law 25

Effective: as shown by the version at the bottom of this page. This policy explains how Whispy, operator of Whispy, collects, uses, discloses, retains and protects personal information.

1. Who is responsible for your information?

Whispy is responsible for personal information held by Whispy. The privacy officer is Romain Sanchez, Founder, who can be reached at contact@whispy.tech.

2. What information do we collect?

• Discord identity: ID, username or display name, avatar, server nickname, relevant servers and roles required for access.
• Account and organization: organizations, owners, groups, permissions, memberships, preferences and session identifiers.
• Operational activity: operations, participation, networks, assignments, partnerships, radio stations, Open-Whispy spaces and administrative actions.
• Billing: payer name and email, associated Discord identity, plan, amounts, currency, status, dates and Stripe customer, subscription, invoice, payment and refund identifiers. Whispy does not receive full card numbers.
• Optional diagnostics: when enabled, app version and operating system, microphone and output availability, whether a PTT shortcut exists, connection count, and network and audio quality measurements. No voice content is included.
• Support and security: support messages, audit logs, security events and technical information needed to investigate an incident.
• Provided content: names, descriptions, configurations and audio files voluntarily uploaded for radio playback.

3. How do we collect it?

We receive information directly from you through the client, Dashboard, checkout or your communications; from Discord when you authenticate or connect a community; from Stripe when you pay; and automatically during service use for sessions, permissions, audits and diagnostics you have enabled.

Client diagnostic sharing is off by default and can be enabled or disabled in settings. Refusing information essential to identity, billing or permissions prevents us from providing the corresponding features.

4. Why do we use it?

We use information to authenticate users, verify eligibility and roles, provide voice and administration features, process subscriptions, prevent abuse, maintain security, support users, improve reliability and meet legal duties.

Depending on the jurisdiction, processing is based on performance of the contract, compliance with law, our legitimate interests in operating and securing the service, or your consent, particularly for optional diagnostics. Whispy does not use personal information for targeted advertising, does not sell it and does not make automated decisions that produce legal effects.

5. Live audio and radio

The client captures microphone audio only when a voice feature requires it. Audio is then transported in real time to authorized participants through LiveKit. Voice activation detects speech locally without recording or transcribing conversations.

This does not apply to audio files an administrator voluntarily uploads for radio playback. Those files are stored for playback until deleted.

6. Who can access it?

Internal access is limited to the operator and people who need it to administer, secure or support Whispy. Organization owners and administrators can view identities, memberships, roles, permissions, activity and shared diagnostics within their organization.

We use the following categories of providers:

• OVHcloud Canada to host the website, API, databases, LiveKit transport and backups;
• Discord for identity, servers and roles;
• Stripe for payments, billing, fraud prevention and refunds; and
• professional advisers or authorities when required by law or justified to protect rights or respond to a security incident.

7. Transfers outside Québec

Whispy’s primary infrastructure is hosted in Canada. Discord and Stripe may process information in other countries where they or their providers operate. Those countries’ laws may allow authorities to access information. Before entrusting information to a provider, Whispy must assess privacy factors and implement appropriate contractual and technical protections.

8. How long do we retain it?

• live voice streams: not retained by Whispy;
• temporary OAuth flow: about 5 minutes;
• Dashboard session: up to 6 hours; renewable desktop session: up to 30 days unless signed out or revoked;
• optional raw diagnostics: 24 hours;
• technical aggregates: 30 days;
• audit logs: 1 year;
• encrypted or access-restricted automatic backups: 7 days;
• account and organization data: for the subscription period, then deleted or anonymized after 12 months of inactivity;
• payment records, invoices and accounting evidence: at least 6 years after the end of the relevant tax year, or longer where required by law or a dispute; and
• radio files: until an authorized person deletes them or the organization is closed, subject to temporary backups.

An organization is inactive when it has no active subscription and none of its users has authenticated or used its resources for 12 months. A pending request, legal duty, fraud prevention need, incident or dispute may justify longer, limited retention.

9. Cookies and local storage

The commercial website uses SecurePrivacy to manage consent preferences and Google Analytics 4 to measure its audience, including page views and visit sources. The consent manager’s settings and your choices determine cookie use and the measurement signals sent to Google. You can review your preferences through the SecurePrivacy manager. These tools are limited to the storefront’s public pages. The Dashboard uses only a secure, JavaScript-inaccessible essential session cookie and a temporary OAuth cookie during sign-in. The desktop client stores session secrets in the operating system’s secure credential vault and preferences locally. Discord and Stripe may use their own cookies on their sites under their policies.

10. How do we protect information?

Measures include encrypted communications, random session secrets whose hashes alone are stored server-side, role-based access, audit logs, access-restricted backups, limited retention periods and operating-system credential storage for client secrets. No safeguards can eliminate all risk.

11. What are your rights?

Depending on applicable law, you may request access, correction, a copy in a structured and commonly used technological format, withdrawal of consent, deletion, restriction of processing or objection to certain processing. Withdrawing consent does not affect prior lawful processing and may make some features unavailable.

Send requests to contact@whispy.tech. We may need to verify your identity. We will respond within the period required by law and explain any refusal or restriction. You may also complain to Québec’s Commission d’accès à l’information or the data-protection authority where you live.

12. Adults only

Whispy is limited to adults and does not knowingly seek personal information from minors. If you believe a minor is using the service, contact the privacy officer so the situation can be reviewed and the information deleted where required.

13. Incidents and changes

Whispy assesses and records privacy incidents and notifies affected people and authorities where required by law. This policy is reviewed when practices or providers change. Changes are published here under a new version, with additional notice when a change is material.

Document version: 1.0